Edit tour

Windows Analysis Report
https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc

Overview

General Information

Sample URL:	https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc
Analysis ID:	1525117
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,11519740772081467594,12038132482264796469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /gen204 HTTP/1.1Host: app.box.comConnection: keep-aliveContent-Length: 449sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Box-Client-Version: 21.315.2X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Request-Token: b7873701837fcebd237f6d33b0e58f165068513d46fc9d3f5389dead5edef401Request-Token: b7873701837fcebd237f6d33b0e58f165068513d46fc9d3f5389dead5edef401sec-ch-ua-platform: "Windows"Origin: https://app.box.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 03 Oct 2024 15:55:27 GMTcontent-type: text/html; charset=utf-8x-robots-tag: noindex, nofollowstrict-transport-security: max-age=31536000expires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheset-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; path=/; domain=.app.box.com; secure; HttpOnlyset-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=Noneset-cookie: box_visitor_id=66febe6f9ce810.68343862; expires=Fri, 03-Oct-2025 15:55:27 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=Noneset-cookie: bv=DEVECO-10562; expires=Thu, 10-Oct-2024 15:55:27 GMT; Max-Age=604800; path=/; domain=.app.box.com; secureset-cookie: cn=59; expires=Fri, 03-Oct-2025 15:55:27 GMT; Max-Age=31536000; path=/; domain=.app.box.com; secureset-cookie: site_preference=desktop; path=/; domain=.box.com; securevia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: closeTransfer-Encoding: chunked

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49831 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /X-Box-Client-Version: 21.315.2X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NFuduc3hyGCd1K&MD=Rnn879Vs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377 HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377 HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NFuduc3hyGCd1K&MD=Rnn879Vs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: app.box.com
Source: global traffic	DNS traffic detected: DNS query: cdn01.boxcdn.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pendo-data-prod.box.com
Source: global traffic	DNS traffic detected: DNS query: cdn.amplitude.com

Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: http://blog.stevenlevithan.com/archives/parseuri
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_181.1.dr, chromecache_164.1.dr, chromecache_223.1.dr	String found in binary or memory: http://www.box.com)
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: https://github.com/derek-watson/jsUri
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: https://support.box.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,11519740772081467594,12038132482264796469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,11519740772081467594,12038132482264796469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

IP	Domain	Country	ASN	ASN Name	Malicious
74.112.186.157	app.box.com	United States	33011	BOXNETUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
18.245.86.101	unknown	United States	16509	AMAZON-02US	false
74.112.186.159	pendo-data-prod.box.com	United States	33011	BOXNETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.245.86.69	cdn.amplitude.com	United States	16509	AMAZON-02US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525117
Start date and time:	2024-10-03 17:54:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/166@18/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 14:55:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.982258278766858
Encrypted:	false
SSDEEP:	48:85d2Ty2JH5idAKZdA1FehwiZUklqehBy+3:8ivxey
MD5:	0DBED9524E5C17A08B635917AB074F6C
SHA1:	D009BB27CBA6C787C30A8744F18D18C74702EA58
SHA-256:	E067D2C523498FFD94F81E05339196A68A14F15625C1DB509470D325D2CA14B1
SHA-512:	BC6C3F192F33CDE39AA1E75DB1AB4041EDC98C35A47A158D08BF500284CFB5B086E5CB714F2AC41B774B7AA7F39F1F547F921F08CF79AF9524B05E3C25D66224
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....m<......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ICY.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCY.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCY.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCY.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCY.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 14:55:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.000213248352875
Encrypted:	false
SSDEEP:	48:8Hd2Ty2JH5idAKZdA1seh/iZUkAQkqehOy+2:8Avn9Qny
MD5:	1C58736D374A3654B30D6089781E4542
SHA1:	7B77E778B2F935526A020D62599393CD548BAC06
SHA-256:	B44CAA6D9E5FB5FE41F8CB9C8A2055432C9DF1785FC46BB2B12DE1761C30F639
SHA-512:	A2EC567EEDA877328EE860751E9471528C62EA3DD06500D22039BA21A5E72424031EC8DD8273BB6C074B52B8C30CA2AA41E231BB738501DA3BE5392902564DCC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....])......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ICY.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCY.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCY.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCY.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCY.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Name	IP	Active	Malicious	Reputation
pendo-data-prod.box.com	74.112.186.159	true	false	unknown
cdn.amplitude.com	18.245.86.69	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
app.box.com	74.112.186.157	true	false	unknown
cdn01.boxcdn.net	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://pendo-data-prod.box.com/data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377	false	unknown
https://app.box.com/app-api/split-proxy/api/mySegments/-1	false	unknown
https://app.box.com/app-api/split-proxy/api/mySegments/2	false	unknown
https://app.box.com/app-api/split-proxy/api/splitChanges?since=-1	false	unknown
https://app.box.com/gen204	false	unknown
https://app.box.com/index.php?rm=box_gen204_batch_record	false	unknown
https://app.box.com/app-api/enduserapp/current-user/features/secondary	false	unknown
https://pendo-data-prod.box.com/data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM	false	unknown
https://pendo-data-prod.box.com/data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod	false	unknown
https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc	false	unknown
https://app.box.com/app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862	false	unknown
https://cdn.amplitude.com/libs/amplitude-4.5.2-min.gz.js	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://blog.stevenlevithan.com/archives/parseuri	chromecache_181.1.dr, chromecache_223.1.dr	false		unknown
https://github.com/derek-watson/jsUri	chromecache_181.1.dr, chromecache_223.1.dr	false		unknown
https://support.box.com	chromecache_181.1.dr, chromecache_223.1.dr	false		unknown
http://www.box.com)	chromecache_181.1.dr, chromecache_164.1.dr, chromecache_223.1.dr	false		unknown
http://jedwatson.github.io/classnames	chromecache_181.1.dr, chromecache_223.1.dr	false	URL Reputation: safe	unknown

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 17:55:26.190016031 CEST	53	59706	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:26.192280054 CEST	53	57868	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:26.966988087 CEST	49893	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:26.967298031 CEST	64358	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:26.977010965 CEST	53	49893	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:26.988001108 CEST	53	64358	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:27.372885942 CEST	53	55795	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:27.938348055 CEST	60750	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:27.938601017 CEST	61586	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:28.737087965 CEST	63023	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:28.737279892 CEST	61924	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:30.931850910 CEST	59826	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:30.932137966 CEST	63816	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:30.939024925 CEST	53	63816	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:30.941071033 CEST	53	59826	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:32.372492075 CEST	53525	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:32.372591972 CEST	59691	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:32.379715919 CEST	53	59691	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:32.380486965 CEST	53	53525	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:33.996124029 CEST	60150	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:33.996279955 CEST	63677	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:34.013025999 CEST	53	63677	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:34.021533012 CEST	53	60150	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:34.651527882 CEST	51758	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:34.651699066 CEST	55273	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:34.661031008 CEST	53	51758	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:34.667948008 CEST	53	55273	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:36.588495016 CEST	52983	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:36.588802099 CEST	63006	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:36.595252037 CEST	53	52983	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:36.596081018 CEST	53	63006	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:38.344219923 CEST	57445	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:38.344434977 CEST	59366	53	192.168.2.16	1.1.1.1
Oct 3, 2024 17:55:38.351403952 CEST	53	59366	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:38.351869106 CEST	53	57445	1.1.1.1	192.168.2.16
Oct 3, 2024 17:55:44.273838997 CEST	53	53389	1.1.1.1	192.168.2.16
Oct 3, 2024 17:56:03.010108948 CEST	53	54592	1.1.1.1	192.168.2.16
Oct 3, 2024 17:56:24.102447987 CEST	138	138	192.168.2.16	192.168.2.255
Oct 3, 2024 17:56:25.719786882 CEST	53	55679	1.1.1.1	192.168.2.16
Oct 3, 2024 17:56:26.147783041 CEST	53	55468	1.1.1.1	192.168.2.16
Oct 3, 2024 17:56:53.501580954 CEST	53	58523	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 3, 2024 17:55:26.988068104 CEST	192.168.2.16	1.1.1.1	c22e	(Port unreachable)	Destination Unreachable
Oct 3, 2024 17:56:26.147841930 CEST	192.168.2.16	1.1.1.1	c230	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-03 15:55:26 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=2995 Date: Thu, 03 Oct 2024 15:55:26 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:27 UTC	688	OUT	GET /s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 15:55:27 UTC	1066	IN	HTTP/1.1 404 Not Found date: Thu, 03 Oct 2024 15:55:27 GMT content-type: text/html; charset=utf-8 x-robots-tag: noindex, nofollow strict-transport-security: max-age=31536000 expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; path=/; domain=.app.box.com; secure; HttpOnly set-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=66febe6f9ce810.68343862; expires=Fri, 03-Oct-2025 15:55:27 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: bv=DEVECO-10562; expires=Thu, 10-Oct-2024 15:55:27 GMT; Max-Age=604800; path=/; domain=.app.box.com; secure set-cookie: cn=59; expires=Fri, 03-Oct-2025 15:55:27 GMT; Max-Age=31536000; path=/; domain=.app.box.com; secure set-cookie: site_preference=desktop; path=/; domain=.box.com; secure via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-10-03 15:55:27 UTC	324	IN	Data Raw: 32 63 30 36 0d 0a 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 72 65 73 69 6e 2d 63 6c 69 65 6e 74 3d 22 77 65 62 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 20 20 3c 74 69 74 6c 65 3e 42 6f 78 Data Ascii: 2c06 <!DOCTYPE html><html lang="en-US" data-resin-client="web"><head><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex, nofollow"> <title>Box
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 30 2e 31 37 2f 6c 61 74 6f 2f 4c 61 74 6f 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 32 22 20 61 73 3d 22 66 6f 6e 74 22 20 74 79 70 65 3d 22 66 6f 6e 74 2f 77 6f 66 66 32 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 2f 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 66 6f 6e 74 73 2f 31 2e 30 2e 31 37 2f 6c 61 74 6f 2f 4c 61 74 6f 2d 42 6f 6c 64 2e 77 6f 66 66 32 22 20 61 73 3d 22 66 6f 6e 74 22 20 74 79 70 65 3d 22 66 6f 6e 74 2f 77 6f 66 66 32 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 2f 3e 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d Data Ascii: 0.17/lato/Lato-Regular.woff2" as="font" type="font/woff2" crossorigin="anonymous" /> <link rel="preload" href="https://cdn01.boxcdn.net/fonts/1.0.17/lato/Lato-Bold.woff2" as="font" type="font/woff2" crossorigin="anonymous" /> <link rel="stylesheet" href=
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 2d 65 6e 2d 55 53 2e 38 35 64 61 66 62 35 38 31 63 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 61 70 70 2e 63 31 32 35 36 37 62 38 65 66 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 Data Ascii: -en-US.85dafb581c.js" as="script" type="text/javascript" crossorigin="anonymous"> <link rel="preload" href="https://cdn01.boxcdn.net/enduser/app.c12567b8ef.js" as="script" type="text/javascript" crossorigin="anonymous"> <link rel="preload" href="https://c
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 65 6e 74 2d 61 73 73 65 74 73 2f 62 6f 78 5f 64 6f 63 67 65 6e 5f 63 6c 69 65 6e 74 5f 72 65 6d 6f 74 65 2e 30 2e 35 37 2e 31 35 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 69 6e 73 69 67 68 74 73 2d 61 73 73 65 74 73 2f 62 6f 78 5f 69 6e 73 69 67 68 74 73 5f 63 6c 69 65 6e 74 5f 72 65 6d 6f 74 65 2e 31 2e 35 35 2e 30 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 Data Ascii: ent-assets/box_docgen_client_remote.0.57.15.js" as="script" type="text/javascript" crossorigin="anonymous"> <link rel="preload" href="https://cdn01.boxcdn.net/insights-assets/box_insights_client_remote.1.55.0.js" as="script" type="text/javascript" crossor
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 31 38 30 78 31 38 30 2d 74 56 30 30 31 63 2e 70 6e 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2d 56 77 57 33 37 62 2e 70 6e 67 22 20 64 61 74 61 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 69 63 6f 6e 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 Data Ascii: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-180x180-tV001c.png"><link rel="icon" type="image/png" href="https://cdn01.boxcdn.net/_assets/img/favicons/favicon-32x32-VwW37b.png" data-notification-icon-href="https://cdn01.boxcdn.net/_asse
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 63 6f 6e 74 65 6e 74 3d 22 23 64 61 35 33 32 63 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 6d 73 74 69 6c 65 2d 31 34 34 78 31 34 34 2d 70 6c 6c 43 4d 38 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 63 6f 6e 66 69 67 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 62 72 6f 77 73 65 72 63 6f 6e 66 69 67 2d 66 64 42 52 65 4b 2e 78 6d 6c 22 3e 0a Data Ascii: content="#da532c"><meta name="msapplication-TileImage" content="https://cdn01.boxcdn.net/_assets/img/favicons/mstile-144x144-pllCM8.png"><meta name="msapplication-config" content="https://cdn01.boxcdn.net/_assets/img/favicons/browserconfig-fdBReK.xml">
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 73 74 6f 72 61 67 65 52 65 6d 61 69 6e 69 6e 67 41 73 53 74 72 69 6e 67 22 3a 22 30 20 42 22 2c 22 68 61 73 55 6e 6c 69 6d 69 74 65 64 53 74 6f 72 61 67 65 22 3a 66 61 6c 73 65 2c 22 74 69 65 72 22 3a 6e 75 6c 6c 2c 22 62 6f 78 54 6f 6f 6c 73 44 6f 77 6e 6c 6f 61 64 55 52 4c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 65 33 2e 62 6f 78 63 64 6e 2e 6e 65 74 5c 2f 62 6f 78 2d 69 6e 73 74 61 6c 6c 65 72 73 5c 2f 62 6f 78 65 64 69 74 5c 2f 77 69 6e 5c 2f 63 75 72 72 65 6e 74 72 65 6c 65 61 73 65 5c 2f 42 6f 78 54 6f 6f 6c 73 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 22 2c 22 61 63 63 6f 75 6e 74 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 63 63 6f 75 6e 74 2e 62 6f 78 2e 63 6f 6d 22 2c 22 61 70 69 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 70 69 Data Ascii: storageRemainingAsString":"0 B","hasUnlimitedStorage":false,"tier":null,"boxToolsDownloadURL":"https:\/\/e3.boxcdn.net\/box-installers\/boxedit\/win\/currentrelease\/BoxToolsInstaller.exe","accountHost":"https:\/\/account.box.com","apiHost":"https:\/\/api
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 73 65 2c 22 63 72 6f 6f 7a 65 22 3a 66 61 6c 73 65 2c 22 63 72 6f 6f 7a 65 4d 61 6e 61 67 65 6d 65 6e 74 22 3a 66 61 6c 73 65 2c 22 64 65 76 65 6c 6f 70 65 72 43 6f 6e 73 6f 6c 65 22 3a 66 61 6c 73 65 2c 22 64 6f 63 67 65 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 41 63 63 65 73 73 53 74 61 74 73 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 41 6c 6c 6f 77 45 64 69 74 6f 72 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 42 72 61 6e 64 69 6e 67 55 73 65 72 45 6e 61 62 6c 65 6d 65 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 6f 72 6d 73 45 6e 61 62 6c 65 64 Data Ascii: se,"crooze":false,"croozeManagement":false,"developerConsole":false,"docgenEnabled":false,"feed":false,"feedAccessStats":false,"fileRequestEnabled":false,"fileRequestAllowEditorsEnabled":false,"fileRequestBrandingUserEnablementEnabled":false,"formsEnabled
2024-10-03 15:55:27 UTC	1224	IN	Data Raw: 6c 69 63 41 70 69 56 31 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 4d 75 6c 74 69 64 6f 63 73 22 3a 74 72 75 65 2c 22 73 69 67 6e 4d 75 6c 74 69 64 6f 63 73 47 65 61 72 32 22 3a 74 72 75 65 2c 22 72 65 6c 61 79 57 65 62 57 6f 72 6b 66 6c 6f 77 54 65 6d 70 6c 61 74 65 73 45 6e 64 70 6f 69 6e 74 73 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 54 65 6d 70 6c 61 74 65 4c 6f 63 6b 69 6e 67 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 52 65 76 69 73 65 52 65 71 75 65 73 74 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 52 65 76 69 73 65 52 65 71 75 65 73 74 47 65 61 72 32 22 3a 66 61 6c 73 65 2c 22 66 6f 6c 64 65 72 4d 65 74 61 64 61 74 61 4f 75 74 63 6f 6d 65 22 3a 66 61 6c 73 65 2c 22 63 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 4c 61 62 65 6c 22 3a 66 61 6c 73 65 2c 22 72 65 6e 61 6d Data Ascii: licApiV1":false,"signMultidocs":true,"signMultidocsGear2":true,"relayWebWorkflowTemplatesEndpoints":false,"signTemplateLocking":false,"signReviseRequest":false,"signReviseRequestGear2":false,"folderMetadataOutcome":false,"classificationLabel":false,"renam
2024-10-03 15:55:27 UTC	1390	IN	Data Raw: 31 33 37 64 0d 0a 70 73 3a 5c 2f 5c 2f 61 70 70 2e 62 6f 78 2e 63 6f 6d 5c 2f 22 2c 22 73 74 61 74 69 63 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 5c 2f 22 2c 22 73 74 61 74 69 63 50 61 74 68 22 3a 22 70 6c 61 74 66 6f 72 6d 5c 2f 70 72 65 76 69 65 77 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 31 30 39 2e 30 22 2c 22 74 6f 6b 65 6e 54 69 6d 65 6f 75 74 22 3a 33 36 30 30 2c 22 70 72 65 6c 6f 61 64 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 6e 6e 6f 74 61 74 69 6f 6e 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 65 78 63 65 6c 4f 6e 6c 69 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 65 78 63 65 6c 4f 6e 6c 69 6e 65 41 6c 6c 6f 77 65 64 4d 61 78 46 69 6c 65 53 69 7a 65 22 3a 35 32 Data Ascii: 137dps:\/\/app.box.com\/","staticHost":"https:\/\/cdn01.boxcdn.net\/","staticPath":"platform\/preview","version":"2.109.0","tokenTimeout":3600,"preloadEnabled":true,"annotationsEnabled":false,"excelOnlineEnabled":false,"excelOnlineAllowedMaxFileSize":52

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-03 15:55:27 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=26005 Date: Thu, 03 Oct 2024 15:55:27 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-03 15:55:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:32 UTC	807	OUT	GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / X-Box-Client-Version: 21.315.2 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
2024-10-03 15:55:32 UTC	749	IN	HTTP/1.1 200 OK date: Thu, 03 Oct 2024 15:55:32 GMT content-type: application/json; charset=utf-8 strict-transport-security: max-age=31536000 expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=66febe6f9ce810.68343862; expires=Fri, 03-Oct-2025 15:55:32 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure x-enduserapp-currentversion: 21.315.2 via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-10-03 15:55:32 UTC	157	IN	Data Raw: 39 32 0d 0a 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 63 61 6e 41 64 64 53 65 61 74 73 22 3a 66 61 6c 73 65 2c 22 63 68 61 74 62 6f 74 22 3a 66 61 6c 73 65 2c 22 70 65 72 73 69 73 74 65 6e 74 44 72 69 76 65 50 72 6f 6d 6f 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 75 70 67 72 61 64 65 49 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 63 61 6e 55 70 67 72 61 64 65 54 72 69 61 6c 22 3a 66 61 6c 73 65 7d 2c 22 65 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 92{"features":{"canAddSeats":false,"chatbot":false,"persistentDrivePromotion":false,"upgradeInline":false,"canUpgradeTrial":false},"experiments":[]}0

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:32 UTC	843	OUT	GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 SplitSDKVersion: javascript-10.23.0 Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42a User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
2024-10-03 15:55:32 UTC	354	IN	HTTP/1.1 200 OK date: Thu, 03 Oct 2024 15:55:32 GMT content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 5 strict-transport-security: max-age=31536000 box-request-id: 03e0eca5f4a0d6a11bbf5ec7cead400b3 via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-10-03 15:55:32 UTC	28	IN	Data Raw: 31 31 0d 0a 7b 22 6d 79 53 65 67 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 11{"mySegments":[]}0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Windows Analysis Report
https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:32 UTC	851	OUT	GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 SplitSDKVersion: javascript-10.23.0 Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42a User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
2024-10-03 15:55:32 UTC	355	IN	HTTP/1.1 200 OK date: Thu, 03 Oct 2024 15:55:32 GMT content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 12 strict-transport-security: max-age=31536000 box-request-id: 049389262f66e25bf8b1d5d75466cbd87 via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-10-03 15:55:32 UTC	1035	IN	Data Raw: 33 64 31 34 0d 0a 7b 22 74 69 6c 6c 22 3a 31 37 32 37 39 36 39 38 38 35 36 33 30 2c 22 73 69 6e 63 65 22 3a 2d 31 2c 22 73 70 6c 69 74 73 22 3a 5b 7b 22 63 68 61 6e 67 65 4e 75 6d 62 65 72 22 3a 31 37 31 38 39 37 36 36 39 31 37 34 34 2c 22 74 72 61 66 66 69 63 54 79 70 65 4e 61 6d 65 22 3a 22 75 73 65 72 5f 69 64 22 2c 22 6e 61 6d 65 22 3a 22 75 73 65 72 5f 70 61 72 74 6e 65 72 73 5f 61 70 70 5f 67 61 6c 6c 65 72 79 5f 73 75 70 70 6f 72 74 5f 66 69 65 6c 64 73 22 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 22 3a 31 30 30 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 53 65 65 64 22 3a 2d 31 36 35 38 34 32 30 35 31 31 2c 22 73 65 65 64 22 3a 37 39 35 31 31 30 32 31 34 2c 22 73 74 61 74 75 73 22 3a 22 41 43 54 49 56 45 22 2c 22 6b 69 Data Ascii: 3d14{"till":1727969885630,"since":-1,"splits":[{"changeNumber":1718976691744,"trafficTypeName":"user_id","name":"user_partners_app_gallery_support_fields","trafficAllocation":100,"trafficAllocationSeed":-1658420511,"seed":795110214,"status":"ACTIVE","ki
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 6c 6c 2c 22 62 65 74 77 65 65 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 6f 6f 6c 65 61 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 22 6f 6e 22 7d 5d 7d 2c 22 70 61 72 74 69 74 69 6f 6e 73 22 3a 5b 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 6e 22 2c 22 73 69 7a 65 22 3a 31 30 30 7d 2c 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 66 66 22 2c 22 73 69 7a 65 22 3a 30 7d 5d 2c 22 6c 61 62 65 6c 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 74 72 65 61 74 6d 65 6e 74 20 6d 61 74 63 68 65 73 20 6f 6e 22 7d 2c 7b 22 63 6f 6e 64 69 74 69 6f 6e 54 79 70 65 22 3a 22 52 4f 4c 4c 4f 55 54 22 Data Ascii: ll,"betweenMatcherData":null,"dependencyMatcherData":null,"booleanMatcherData":null,"stringMatcherData":"on"}]},"partitions":[{"treatment":"on","size":100},{"treatment":"off","size":0}],"label":"enterprise_treatment matches on"},{"conditionType":"ROLLOUT"
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 7d 5d 7d 2c 22 70 61 72 74 69 74 69 6f 6e 73 22 3a 5b 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 6e 22 2c 22 73 69 7a 65 22 3a 30 7d 2c 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 66 66 22 2c 22 73 69 7a 65 22 3a 31 30 30 7d 5d 2c 22 6c 61 62 65 6c 22 3a 22 69 6e 20 73 70 6c 69 74 20 67 78 70 5f 66 65 61 74 75 72 65 73 5f 71 33 32 34 20 74 72 65 61 74 6d 65 6e 74 20 5b 6f 66 66 5d 22 7d 2c 7b 22 63 6f 6e 64 69 74 69 6f 6e 54 79 70 65 22 3a 22 52 4f 4c 4c 4f 55 54 22 2c 22 6d 61 74 63 68 65 72 47 72 6f 75 70 22 3a 7b 22 63 6f 6d 62 69 6e 65 72 22 3a 22 41 4e 44 22 2c 22 6d 61 74 63 68 65 72 73 22 3a 5b 7b 22 6b 65 79 53 65 6c 65 63 74 6f 72 22 Data Ascii: erData":null,"stringMatcherData":null}]},"partitions":[{"treatment":"on","size":0},{"treatment":"off","size":100}],"label":"in split gxp_features_q324 treatment [off]"},{"conditionType":"ROLLOUT","matcherGroup":{"combiner":"AND","matchers":[{"keySelector"
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 7a 65 22 3a 30 7d 5d 2c 22 6c 61 62 65 6c 22 3a 22 64 65 66 61 75 6c 74 20 72 75 6c 65 22 7d 5d 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 73 22 3a 7b 7d 2c 22 73 65 74 73 22 3a 5b 5d 7d 2c 7b 22 63 68 61 6e 67 65 4e 75 6d 62 65 72 22 3a 31 37 31 33 31 37 33 32 32 34 37 31 39 2c 22 74 72 61 66 66 69 63 54 79 70 65 4e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 6e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 65 6e 61 62 6c 65 5f 70 61 73 73 77 6f 72 64 5f 72 65 73 65 74 5f 73 65 6e 64 69 6e 67 5f 76 69 61 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 5f 70 6c 61 74 66 6f 72 6d 22 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 22 3a 31 30 30 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 53 65 65 64 22 3a 32 34 Data Ascii: ze":0}],"label":"default rule"}],"configurations":{},"sets":[]},{"changeNumber":1713173224719,"trafficTypeName":"enterprise_id","name":"enterprise_enable_password_reset_sending_via_notifications_platform","trafficAllocation":100,"trafficAllocationSeed":24
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 22 2c 22 73 69 7a 65 22 3a 30 7d 5d 2c 22 6c 61 62 65 6c 22 3a 22 69 6e 20 6c 69 73 74 20 5b 31 30 36 35 33 35 39 36 30 36 2c 20 32 37 33 33 35 5d 22 7d 2c 7b 22 63 6f 6e 64 69 74 69 6f 6e 54 79 70 65 22 3a 22 52 4f 4c 4c 4f 55 54 22 2c 22 6d 61 74 63 68 65 72 47 72 6f 75 70 22 3a 7b 22 63 6f 6d 62 69 6e 65 72 22 3a 22 41 4e 44 22 2c 22 6d 61 74 63 68 65 72 73 22 3a 5b 7b 22 6b 65 79 53 65 6c 65 63 74 6f 72 22 3a 7b 22 74 72 61 66 66 69 63 54 79 70 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 61 74 74 72 69 62 75 74 65 22 3a 6e 75 6c 6c 7d 2c 22 6d 61 74 63 68 65 72 54 79 70 65 22 3a 22 49 4e 5f 53 50 4c 49 54 5f 54 52 45 41 54 4d 45 4e 54 22 2c 22 6e 65 67 61 74 65 22 3a 66 61 6c 73 65 2c 22 75 73 65 72 44 65 66 69 6e 65 64 53 65 67 6d 65 Data Ascii: ","size":0}],"label":"in list [1065359606, 27335]"},{"conditionType":"ROLLOUT","matcherGroup":{"combiner":"AND","matchers":[{"keySelector":{"trafficType":"enterprise_id","attribute":null},"matcherType":"IN_SPLIT_TREATMENT","negate":false,"userDefinedSegme
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 6e 64 69 74 69 6f 6e 73 22 3a 5b 7b 22 63 6f 6e 64 69 74 69 6f 6e 54 79 70 65 22 3a 22 57 48 49 54 45 4c 49 53 54 22 2c 22 6d 61 74 63 68 65 72 47 72 6f 75 70 22 3a 7b 22 63 6f 6d 62 69 6e 65 72 22 3a 22 41 4e 44 22 2c 22 6d 61 74 63 68 65 72 73 22 3a 5b 7b 22 6b 65 79 53 65 6c 65 63 74 6f 72 22 3a 6e 75 6c 6c 2c 22 6d 61 74 63 68 65 72 54 79 70 65 22 3a 22 57 48 49 54 45 4c 49 53 54 22 2c 22 6e 65 67 61 74 65 22 3a 66 61 6c 73 65 2c 22 75 73 65 72 44 65 66 69 6e 65 64 53 65 67 6d 65 6e 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 77 68 69 74 65 6c 69 73 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 7b 22 77 68 69 74 65 6c 69 73 74 22 3a 5b 22 38 39 35 36 38 32 30 37 39 22 5d 7d 2c 22 75 6e 61 72 79 4e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 44 Data Ascii: nditions":[{"conditionType":"WHITELIST","matcherGroup":{"combiner":"AND","matchers":[{"keySelector":null,"matcherType":"WHITELIST","negate":false,"userDefinedSegmentMatcherData":null,"whitelistMatcherData":{"whitelist":["895682079"]},"unaryNumericMatcherD
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 22 45 51 55 41 4c 5f 54 4f 5f 42 4f 4f 4c 45 41 4e 22 2c 22 6e 65 67 61 74 65 22 3a 66 61 6c 73 65 2c 22 75 73 65 72 44 65 66 69 6e 65 64 53 65 67 6d 65 6e 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 77 68 69 74 65 6c 69 73 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 75 6e 61 72 79 4e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 6f 6f 6c 65 61 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 74 72 75 65 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 7d 5d 7d 2c 22 70 61 72 74 69 74 69 6f 6e 73 22 3a 5b 7b 22 Data Ascii: "EQUAL_TO_BOOLEAN","negate":false,"userDefinedSegmentMatcherData":null,"whitelistMatcherData":null,"unaryNumericMatcherData":null,"betweenMatcherData":null,"dependencyMatcherData":null,"booleanMatcherData":true,"stringMatcherData":null}]},"partitions":[{"
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 68 65 72 44 61 74 61 22 3a 7b 22 73 65 67 6d 65 6e 74 4e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 73 68 69 65 6c 64 5f 72 6c 5f 73 65 67 6d 65 6e 74 5f 62 6f 78 65 72 22 7d 2c 22 77 68 69 74 65 6c 69 73 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 75 6e 61 72 79 4e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 6f 6f 6c 65 61 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 7d 5d 7d 2c 22 70 61 72 74 69 74 69 6f 6e 73 22 3a 5b 7b 22 74 72 65 61 74 6d 65 6e 74 Data Ascii: herData":{"segmentName":"enterprise_shield_rl_segment_boxer"},"whitelistMatcherData":null,"unaryNumericMatcherData":null,"betweenMatcherData":null,"dependencyMatcherData":null,"booleanMatcherData":null,"stringMatcherData":null}]},"partitions":[{"treatment
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 70 72 6f 76 65 6d 65 6e 74 73 5f 65 78 65 6d 70 74 5f 75 73 65 72 73 5f 67 72 6f 75 70 73 5f 64 6f 6d 61 69 6e 73 5f 71 33 66 79 32 33 22 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 22 3a 31 30 30 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 53 65 65 64 22 3a 2d 32 30 34 30 35 37 32 37 35 2c 22 73 65 65 64 22 3a 35 32 31 32 34 35 36 32 2c 22 73 74 61 74 75 73 22 3a 22 41 43 54 49 56 45 22 2c 22 6b 69 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 64 65 66 61 75 6c 74 54 72 65 61 74 6d 65 6e 74 22 3a 22 6f 66 66 22 2c 22 61 6c 67 6f 22 3a 32 2c 22 63 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 7b 22 63 6f 6e 64 69 74 69 6f 6e 54 79 70 65 22 3a 22 57 48 49 54 45 4c 49 53 54 22 2c 22 6d 61 74 63 68 65 72 47 72 6f 75 70 22 3a 7b 22 63 6f 6d 62 69 6e Data Ascii: provements_exempt_users_groups_domains_q3fy23","trafficAllocation":100,"trafficAllocationSeed":-204057275,"seed":52124562,"status":"ACTIVE","killed":false,"defaultTreatment":"off","algo":2,"conditions":[{"conditionType":"WHITELIST","matcherGroup":{"combin
2024-10-03 15:55:32 UTC	1390	IN	Data Raw: 65 63 74 6f 72 22 3a 7b 22 74 72 61 66 66 69 63 54 79 70 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 61 74 74 72 69 62 75 74 65 22 3a 6e 75 6c 6c 7d 2c 22 6d 61 74 63 68 65 72 54 79 70 65 22 3a 22 41 4c 4c 5f 4b 45 59 53 22 2c 22 6e 65 67 61 74 65 22 3a 66 61 6c 73 65 2c 22 75 73 65 72 44 65 66 69 6e 65 64 53 65 67 6d 65 6e 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 77 68 69 74 65 6c 69 73 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 75 6e 61 72 79 4e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 6f 6f 6c 65 61 6e Data Ascii: ector":{"trafficType":"enterprise_id","attribute":null},"matcherType":"ALL_KEYS","negate":false,"userDefinedSegmentMatcherData":null,"whitelistMatcherData":null,"unaryNumericMatcherData":null,"betweenMatcherData":null,"dependencyMatcherData":null,"boolean

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:32 UTC	512	OUT	GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1 Host: app.box.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
2024-10-03 15:55:33 UTC	749	IN	HTTP/1.1 200 OK date: Thu, 03 Oct 2024 15:55:33 GMT content-type: application/json; charset=utf-8 strict-transport-security: max-age=31536000 expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=66febe6f9ce810.68343862; expires=Fri, 03-Oct-2025 15:55:33 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure x-enduserapp-currentversion: 21.315.2 via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-10-03 15:55:33 UTC	157	IN	Data Raw: 39 32 0d 0a 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 63 61 6e 41 64 64 53 65 61 74 73 22 3a 66 61 6c 73 65 2c 22 63 68 61 74 62 6f 74 22 3a 66 61 6c 73 65 2c 22 70 65 72 73 69 73 74 65 6e 74 44 72 69 76 65 50 72 6f 6d 6f 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 75 70 67 72 61 64 65 49 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 63 61 6e 55 70 67 72 61 64 65 54 72 69 61 6c 22 3a 66 61 6c 73 65 7d 2c 22 65 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 92{"features":{"canAddSeats":false,"chatbot":false,"persistentDrivePromotion":false,"upgradeInline":false,"canUpgradeTrial":false},"experiments":[]}0

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NFuduc3hyGCd1K&MD=Rnn879Vs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-03 15:55:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: aecb5213-21f7-4fa3-bb45-a87b6e5c09ab MS-RequestId: 51526bd9-b972-40a2-bd07-32ae88e83942 MS-CV: gDpLGUbDdUCChQJd.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 03 Oct 2024 15:55:32 GMT Connection: close Content-Length: 24490
2024-10-03 15:55:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-03 15:55:33 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:34 UTC	507	OUT	GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1 Host: app.box.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
2024-10-03 15:55:34 UTC	308	IN	HTTP/1.1 401 Unauthorized date: Thu, 03 Oct 2024 15:55:34 GMT x-envoy-upstream-service-time: 5 strict-transport-security: max-age=31536000 box-request-id: 0d78c8cafcc1135df862aa22556c49c66 via: 1.1 google Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:34 UTC	993	OUT	POST /gen204 HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 449 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Box-Client-Version: 21.315.2 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json X-Request-Token: b7873701837fcebd237f6d33b0e58f165068513d46fc9d3f5389dead5edef401 Request-Token: b7873701837fcebd237f6d33b0e58f165068513d46fc9d3f5389dead5edef401 sec-ch-ua-platform: "Windows" Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
2024-10-03 15:55:34 UTC	449	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 65 75 61 5f 70 65 72 66 6f 72 6d 61 6e 63 65 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 77 6a 31 30 6b 32 68 75 39 6e 66 6a 38 6e 6b 31 22 2c 22 62 72 6f 77 73 65 72 5f 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 22 2c 22 62 72 6f 77 73 65 72 5f 76 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 22 2c 22 64 65 76 69 63 65 5f 6e 61 6d 65 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 70 65 72 66 6f 72 6d 61 6e 63 65 5f 69 64 22 3a 22 73 70 6c 69 74 22 2c 22 73 74 61 72 74 5f 73 74 61 74 65 22 3a 22 69 6e 69 74 69 61 6c 22 2c 22 65 Data Ascii: {"data":[{"category":"eua_performance","event_type":"web","country_code":"US","request_id":"wj10k2hu9nfj8nk1","browser_name":"Chrome","browser_version":"117.0","os_name":"Windows","device_name":"unknown","performance_id":"split","start_state":"initial","e
2024-10-03 15:55:34 UTC	772	IN	HTTP/1.1 204 No Content date: Thu, 03 Oct 2024 15:55:34 GMT content-type: text/html;charset=UTF-8 strict-transport-security: max-age=31536000 access-control-allow-origin: https://app.box.com access-control-allow-credentials: true expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=66febe6f9ce810.68343862; expires=Fri, 03-Oct-2025 15:55:34 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:34 UTC	914	OUT	GET /data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377 HTTP/1.1 Host: pendo-data-prod.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://app.box.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 15:55:34 UTC	545	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 content-type: application/json x-content-type-options: nosniff date: Thu, 03 Oct 2024 15:55:34 GMT x-envoy-upstream-service-time: 8 server: istio-envoy via: 1.1 google, 1.1 google strict-transport-security: max-age=63072000 alt-svc: clear Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-10-03 15:55:34 UTC	845	IN	Data Raw: 32 65 37 66 0d 0a 7b 22 67 75 69 64 65 73 22 3a 5b 5d 2c 22 6e 6f 72 6d 61 6c 69 7a 65 64 55 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 61 70 70 2e 62 6f 78 2e 63 6f 6d 2f 73 2f 72 38 67 66 36 7a 70 67 67 30 74 68 39 6b 6c 34 7a 30 70 66 78 34 74 65 66 6a 73 76 65 78 76 63 22 2c 22 6c 61 73 74 47 75 69 64 65 53 74 65 70 53 65 65 6e 22 3a 7b 22 69 73 4d 75 6c 74 69 53 74 65 70 22 3a 66 61 6c 73 65 2c 22 73 74 61 74 65 22 3a 22 22 7d 2c 22 67 75 69 64 65 57 69 64 67 65 74 22 3a 7b 22 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 68 69 64 65 50 6f 77 65 72 65 64 42 79 22 3a 66 61 6c 73 65 2c 22 64 61 74 61 22 3a 7b 22 67 75 69 64 65 43 73 73 55 72 6c 22 3a 22 22 2c 22 6f 6e 62 6f 61 72 64 69 6e 67 22 3a 66 61 6c 73 65 7d 7d 2c 22 67 75 69 64 65 43 73 73 55 72 6c Data Ascii: 2e7f{"guides":[],"normalizedUrl":"http://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc","lastGuideStepSeen":{"isMultiStep":false,"state":""},"guideWidget":{"enabled":false,"hidePoweredBy":false,"data":{"guideCssUrl":"","onboarding":false}},"guideCssUrl
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 22 2c 22 74 79 70 65 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 22 3a 22 22 7d 5d 2c 22 70 61 67 65 49 64 22 3a 22 22 2c 22 66 65 61 74 75 72 65 49 64 22 3a 22 63 72 37 6a 47 43 34 4d 45 6f 37 4d 6a 52 6a 52 43 66 66 74 6f 55 49 6e 45 66 45 22 2c 22 66 65 61 74 75 72 65 52 75 6c 65 22 3a 5b 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 63 6f 6d 70 6f 6e 65 6e 74 3d 5c 22 68 65 61 64 65 72 5c 22 5d 5b 64 61 74 61 2d 72 65 73 69 6e 2d 66 65 61 74 75 72 65 3d 5c 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 5c 22 5d 5b 64 61 74 61 2d 72 65 73 69 6e 2d 74 61 72 67 65 74 3d 5c 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 69 63 6f 6e 5c 22 5d 22 5d 7d 2c 7b 22 65 76 65 6e 74 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 6e 61 Data Ascii: "[data-resin-page]","type":"","pattern":""}],"pageId":"","featureId":"cr7jGC4MEo7MjRjRCfftoUInEfE","featureRule":["[data-resin-component=\"header\"][data-resin-feature=\"notifications\"][data-resin-target=\"notificationsicon\"]"]},{"eventProperties":[{"na
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 73 69 6e 50 61 67 65 5c 22 7d 22 2c 22 69 73 41 63 74 69 76 65 22 3a 74 72 75 65 2c 22 70 61 74 68 22 3a 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 50 61 67 65 22 2c 22 73 65 6c 65 63 74 6f 72 22 3a 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 22 2c 22 74 79 70 65 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 22 3a 22 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 72 65 73 69 6e 5f 66 6f 6c 64 65 72 5f 69 64 22 2c 22 72 75 6c 65 22 3a 22 7b 5c 22 6e 61 6d 65 5c 22 3a 5c 22 72 65 73 69 6e 5f 66 6f 6c 64 65 72 5f 69 64 5c 22 2c 5c 22 73 6f 75 72 63 65 5c 22 3a 5c 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 66 6f 6c 64 65 72 5f 69 64 5d 5c 22 2c 5c 22 70 61 74 68 5c 22 3a 5c 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 46 6f 6c 64 65 72 5f 69 64 5c 22 7d 22 2c 22 69 73 41 63 Data Ascii: sinPage\"}","isActive":true,"path":"dataset.resinPage","selector":"[data-resin-page]","type":"","pattern":""},{"name":"resin_folder_id","rule":"{\"name\":\"resin_folder_id\",\"source\":\"[data-resin-folder_id]\",\"path\":\"dataset.resinFolder_id\"}","isAc
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 22 2c 5c 22 70 61 74 68 5c 22 3a 5c 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 50 61 67 65 5c 22 7d 22 2c 22 69 73 41 63 74 69 76 65 22 3a 74 72 75 65 2c 22 70 61 74 68 22 3a 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 50 61 67 65 22 2c 22 73 65 6c 65 63 74 6f 72 22 3a 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 22 2c 22 74 79 70 65 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 22 3a 22 22 7d 5d 2c 22 70 61 67 65 49 64 22 3a 22 22 2c 22 66 65 61 74 75 72 65 49 64 22 3a 22 31 47 4c 62 65 53 61 50 78 4b 44 7a 57 73 69 39 75 30 6b 4c 59 58 47 34 56 6b 51 22 2c 22 66 65 61 74 75 72 65 52 75 6c 65 22 3a 5b 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 63 6f 6d 70 6f 6e 65 6e 74 3d 5c 22 6d 6f 64 61 6c 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 74 61 72 67 65 74 Data Ascii: ",\"path\":\"dataset.resinPage\"}","isActive":true,"path":"dataset.resinPage","selector":"[data-resin-page]","type":"","pattern":""}],"pageId":"","featureId":"1GLbeSaPxKDzWsi9u0kLYXG4VkQ","featureRule":["[data-resin-component=\"modal\"] [data-resin-target
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 73 49 70 69 4f 34 6f 4c 67 22 2c 22 66 65 61 74 75 72 65 52 75 6c 65 22 3a 5b 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 63 6f 6d 70 6f 6e 65 6e 74 3d 5c 22 62 6f 64 79 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 66 65 61 74 75 72 65 3d 5c 22 75 70 67 72 61 64 65 43 68 65 63 6b 6f 75 74 53 74 65 70 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 74 61 72 67 65 74 3d 5c 22 61 64 64 72 65 73 73 43 6f 6e 74 69 6e 75 65 64 5c 22 5d 22 5d 7d 2c 7b 22 65 76 65 6e 74 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 72 65 73 69 6e 5f 70 61 67 65 22 2c 22 72 75 6c 65 22 3a 22 7b 5c 22 6e 61 6d 65 5c 22 3a 5c 22 72 65 73 69 6e 5f 70 61 67 65 5c 22 2c 5c 22 73 6f 75 72 63 65 5c 22 3a 5c 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 5c 22 2c Data Ascii: sIpiO4oLg","featureRule":["[data-resin-component=\"body\"] [data-resin-feature=\"upgradeCheckoutStep\"] [data-resin-target=\"addressContinued\"]"]},{"eventProperties":[{"name":"resin_page","rule":"{\"name\":\"resin_page\",\"source\":\"[data-resin-page]\",
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 5b 7b 22 6e 61 6d 65 22 3a 22 72 65 73 69 6e 5f 70 61 67 65 22 2c 22 72 75 6c 65 22 3a 22 7b 5c 22 6e 61 6d 65 5c 22 3a 5c 22 72 65 73 69 6e 5f 70 61 67 65 5c 22 2c 5c 22 73 6f 75 72 63 65 5c 22 3a 5c 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 5c 22 2c 5c 22 70 61 74 68 5c 22 3a 5c 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 50 61 67 65 5c 22 7d 22 2c 22 69 73 41 63 74 69 76 65 22 3a 74 72 75 65 2c 22 70 61 74 68 22 3a 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 50 61 67 65 22 2c 22 73 65 6c 65 63 74 6f 72 22 3a 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 22 2c 22 74 79 70 65 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 22 3a 22 22 7d 5d 2c 22 70 61 67 65 49 64 22 3a 22 22 2c 22 66 65 61 74 75 72 65 49 64 22 3a 22 34 72 38 5a 4e 4a 4f 48 47 50 Data Ascii: [{"name":"resin_page","rule":"{\"name\":\"resin_page\",\"source\":\"[data-resin-page]\",\"path\":\"dataset.resinPage\"}","isActive":true,"path":"dataset.resinPage","selector":"[data-resin-page]","type":"","pattern":""}],"pageId":"","featureId":"4r8ZNJOHGP
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 74 2e 72 65 73 69 6e 50 61 67 65 22 2c 22 73 65 6c 65 63 74 6f 72 22 3a 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 22 2c 22 74 79 70 65 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 22 3a 22 22 7d 5d 2c 22 70 61 67 65 49 64 22 3a 22 22 2c 22 66 65 61 74 75 72 65 49 64 22 3a 22 37 59 75 35 4c 33 65 76 42 4e 31 38 43 2d 39 31 43 6e 76 5f 68 59 6f 59 65 48 6f 22 2c 22 66 65 61 74 75 72 65 52 75 6c 65 22 3a 5b 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 63 6f 6d 70 6f 6e 65 6e 74 3d 5c 22 6d 6f 64 61 6c 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 66 65 61 74 75 72 65 3d 5c 22 75 70 67 72 61 64 65 43 68 65 63 6b 6f 75 74 53 74 65 70 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 74 61 72 67 65 74 3d 5c 22 63 68 61 6e 67 65 50 6c 61 6e 4c 69 6e 6b 5c 22 5d Data Ascii: t.resinPage","selector":"[data-resin-page]","type":"","pattern":""}],"pageId":"","featureId":"7Yu5L3evBN18C-91Cnv_hYoYeHo","featureRule":["[data-resin-component=\"modal\"] [data-resin-feature=\"upgradeCheckoutStep\"] [data-resin-target=\"changePlanLink\"]
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 3a 22 38 41 41 36 77 70 61 50 4a 39 73 4b 50 4c 37 45 4e 4e 5a 46 37 68 63 58 36 71 4d 22 2c 22 66 65 61 74 75 72 65 52 75 6c 65 22 3a 5b 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 63 6f 6d 70 6f 6e 65 6e 74 3d 5c 22 6d 6f 64 61 6c 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 66 65 61 74 75 72 65 3d 5c 22 75 70 67 72 61 64 65 43 68 65 63 6b 6f 75 74 53 74 65 70 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 74 61 72 67 65 74 3d 5c 22 73 74 72 65 65 74 41 64 64 72 65 73 73 46 69 65 6c 64 5c 22 5d 22 5d 7d 2c 7b 22 65 76 65 6e 74 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 72 65 73 69 6e 5f 70 61 67 65 22 2c 22 72 75 6c 65 22 3a 22 7b 5c 22 6e 61 6d 65 5c 22 3a 5c 22 72 65 73 69 6e 5f 70 61 67 65 5c 22 2c 5c 22 73 6f 75 72 63 65 5c 22 Data Ascii: :"8AA6wpaPJ9sKPL7ENNZF7hcX6qM","featureRule":["[data-resin-component=\"modal\"] [data-resin-feature=\"upgradeCheckoutStep\"] [data-resin-target=\"streetAddressField\"]"]},{"eventProperties":[{"name":"resin_page","rule":"{\"name\":\"resin_page\",\"source\"
2024-10-03 15:55:34 UTC	1336	IN	Data Raw: 66 65 61 74 75 72 65 3d 5c 22 75 70 67 72 61 64 65 43 68 65 63 6b 6f 75 74 53 74 65 70 5c 22 5d 20 5b 64 61 74 61 2d 72 65 73 69 6e 2d 74 61 72 67 65 74 3d 5c 22 63 69 74 79 46 69 65 6c 64 5c 22 5d 22 5d 7d 2c 7b 22 65 76 65 6e 74 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 72 65 73 69 6e 5f 70 61 67 65 22 2c 22 72 75 6c 65 22 3a 22 7b 5c 22 6e 61 6d 65 5c 22 3a 5c 22 72 65 73 69 6e 5f 70 61 67 65 5c 22 2c 5c 22 73 6f 75 72 63 65 5c 22 3a 5c 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 5c 22 2c 5c 22 70 61 74 68 5c 22 3a 5c 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 50 61 67 65 5c 22 7d 22 2c 22 69 73 41 63 74 69 76 65 22 3a 74 72 75 65 2c 22 70 61 74 68 22 3a 22 64 61 74 61 73 65 74 2e 72 65 73 69 6e 50 61 67 65 22 2c 22 73 Data Ascii: feature=\"upgradeCheckoutStep\"] [data-resin-target=\"cityField\"]"]},{"eventProperties":[{"name":"resin_page","rule":"{\"name\":\"resin_page\",\"source\":\"[data-resin-page]\",\"path\":\"dataset.resinPage\"}","isActive":true,"path":"dataset.resinPage","s
2024-10-03 15:55:34 UTC	1390	IN	Data Raw: 32 35 35 63 0d 0a 22 74 61 73 6b 5f 76 61 6c 75 65 5c 22 2c 5c 22 73 6f 75 72 63 65 5c 22 3a 5c 22 2e 69 73 2d 76 69 73 69 62 6c 65 5c 22 2c 5c 22 70 61 74 68 5c 22 3a 5c 22 69 6e 6e 65 72 54 65 78 74 5c 22 7d 22 2c 22 69 73 41 63 74 69 76 65 22 3a 74 72 75 65 2c 22 70 61 74 68 22 3a 22 69 6e 6e 65 72 54 65 78 74 22 2c 22 73 65 6c 65 63 74 6f 72 22 3a 22 2e 69 73 2d 76 69 73 69 62 6c 65 22 2c 22 74 79 70 65 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 22 3a 22 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 72 65 73 69 6e 5f 70 61 67 65 22 2c 22 72 75 6c 65 22 3a 22 7b 5c 22 6e 61 6d 65 5c 22 3a 5c 22 72 65 73 69 6e 5f 70 61 67 65 5c 22 2c 5c 22 73 6f 75 72 63 65 5c 22 3a 5c 22 5b 64 61 74 61 2d 72 65 73 69 6e 2d 70 61 67 65 5d 5c 22 2c 5c 22 70 61 74 68 5c 22 3a 5c 22 64 Data Ascii: 255c"task_value\",\"source\":\".is-visible\",\"path\":\"innerText\"}","isActive":true,"path":"innerText","selector":".is-visible","type":"","pattern":""},{"name":"resin_page","rule":"{\"name\":\"resin_page\",\"source\":\"[data-resin-page]\",\"path\":\"d

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:34 UTC	658	OUT	GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1 Host: pendo-data-prod.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://app.box.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 15:55:34 UTC	530	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 content-type: image/gif x-content-type-options: nosniff date: Thu, 03 Oct 2024 15:55:34 GMT Content-Length: 42 x-envoy-upstream-service-time: 2 server: istio-envoy via: 1.1 google, 1.1 google strict-transport-security: max-age=63072000 alt-svc: clear Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-03 15:55:34 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:34 UTC	1207	OUT	GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM HTTP/1.1 Host: pendo-data-prod.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://app.box.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
2024-10-03 15:55:34 UTC	531	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 content-type: image/gif x-content-type-options: nosniff date: Thu, 03 Oct 2024 15:55:34 GMT Content-Length: 42 x-envoy-upstream-service-time: 27 server: istio-envoy via: 1.1 google, 1.1 google strict-transport-security: max-age=63072000 alt-svc: clear Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-03 15:55:34 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:35 UTC	536	OUT	GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1 Host: pendo-data-prod.box.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
2024-10-03 15:55:35 UTC	530	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 content-type: image/gif x-content-type-options: nosniff date: Thu, 03 Oct 2024 15:55:35 GMT Content-Length: 42 x-envoy-upstream-service-time: 1 server: istio-envoy via: 1.1 google, 1.1 google strict-transport-security: max-age=63072000 alt-svc: clear Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-03 15:55:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-10-03 15:55:37 UTC	842	OUT	GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 SplitSDKVersion: javascript-10.23.0 Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42a User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
2024-10-03 15:55:37 UTC	354	IN	HTTP/1.1 200 OK date: Thu, 03 Oct 2024 15:55:37 GMT content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 4 strict-transport-security: max-age=31536000 box-request-id: 0adf7bfc9944381dd71e9c1563c499a82 via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-10-03 15:55:37 UTC	28	IN	Data Raw: 31 31 0d 0a 7b 22 6d 79 53 65 67 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 11{"mySegments":[]}0