Windows Analysis Report
https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza

Overview

General Information

Sample URL:	https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza
Analysis ID:	1428925
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.com

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49766 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49805 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49766 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91

Source: global traffic	HTTP traffic detected: GET /s/hiphn6dvy4mquaedfrgoqd500cedhaza HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notes/1507423751787?s=hiphn6dvy4mquaedfrgoqd500cedhaza HTTP/1.1Host: app.box.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=9n77r96la30bf8tu33ersii86u; box_visitor_id=6622c585656315.12660618; bv=EUG-6777; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.com HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/unknown HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/splitChanges?since=-1 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /app_init HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/2 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/6622c585656315.12660618 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxCK HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-acf20a40200fb9c5b0dab3a41615218b-edaa96f17e2ef07c-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/unknown HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /analytics-events/ HTTP/1.1Host: client-log.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/splitChanges?since=-1 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/2 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/6622c585656315.12660618 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2USec-WebSocket-Key: SoLULLVSSFNLBn+nC0nz0Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxXJ&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-4c34e2c983e16ee44fb6aafd6a3da25c-a299f84703e7225a-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxCK HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3P+plw2MLKztap8&MD=wOwOpKc2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjq&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-182e7cf47b8de31275a3a5fb941bd474-e66e5d5d0d14ebcf-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxX2&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxXJ&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjs&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjq&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=Plv5uLxd-X7CJS8fZUouqZCIM6q4mg1jPts8
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823831 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"feature-flip-user-id: 2traceparent: 00-1fca511418f7e6090adf33179d30840c-5bb9effaaf205748-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: Plv5uLxd-X7CJS8fZUouqZCIM6q4mg1jPts8X-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=Plv5uLxd-X7CJS8fZUouqZCIM6q4mg1jPts8
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=RJU9eqWk-ZB4qrwv4Cdu6lCecNxSble7OrgA
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823831 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=fr7pEI5L-SyMLsLBUyINybb81eNjTe-j2Jkc
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyNh HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-b3d41d94e08938e2850f7c58b6f34ef6-7d8eb2cdeef52cc7-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=fr7pEI5L-SyMLsLBUyINybb81eNjTe-j2Jkc
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70gSec-WebSocket-Key: RcUYTgtpirPWvRH1y3iCzg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXU&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-71fc57c9117c0730449d6e3bba7befb2-d77b1c3cfa6542ed-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyNh HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqyf-&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-28d5024e6b1e0ea2aef64a54ed092f99-ee553446eedc5e58-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXR&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXU&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqyg1&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=os04CMgK-r5tt7CqLxQPrmVxhAPdMRbQdsJ8
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823832 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"feature-flip-user-id: 2traceparent: 00-71f3e78d1603052e83302c36e35c5019-329c2d60d7e42223-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: Joph68a2-lk4upR6QocxZnNV-qOHzY4UNUkAX-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=Joph68a2-lk4upR6QocxZnNV-qOHzY4UNUkA
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=VjokEQeC-yBV3ukJgnIrp4a6GWU07CG6BWXk
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823832 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=aKsLTHRm-SK-_oCsSeyBBQmqV5lup5o2QTpw
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0FA HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-8dad3bb5a90c4a233471631e7a1c3160-0af9794f053cd476-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=aKsLTHRm-SK-_oCsSeyBBQmqV5lup5o2QTpw
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0FA HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nj&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-325205831dda6ed9c21e34f8623ad474-e13726f147d2beb0-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCMSec-WebSocket-Key: JRKy8VsRH7t95WCd1/KiFQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nh&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0WB&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-5b4dc8ea67a6beddf39d06bf0a3bf1fa-920aa06126bded7d-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nj&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0WC&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=zSERwLff-yOWNRRDocNzXWgOoITSnFM8hvw4
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3P+plw2MLKztap8&MD=wOwOpKc2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /analytics-events/ HTTP/1.1Host: client-log.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823833 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"feature-flip-user-id: 2traceparent: 00-b091cd5ad75375f2539b0f4e6e67b46f-cdd447714fc7bda1-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: 5Kll1y7t-UyZv2s_aN0qKuvsKmyQ8LnYc2dYX-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=5Kll1y7t-UyZv2s_aN0qKuvsKmyQ8LnYc2dY; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=hRftp0bj-hcCg7ezbtuKnFUrSW23HWTOzYAs
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823833 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fE
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr70_ HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-59c96ba84876b5a2248721c35ccd6bd4-b3a7cb6f1e4f21dc-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fE
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fESec-WebSocket-Key: 6t3Nt6nx38qOxgGA4z1cog==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr70_ HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Be&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-665743357cf98236e6dde7a39e22d4a4-eca199efcb2e514c-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fE
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Bb&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Be&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7KL&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-b70f43d5aaea5a21f216b5828690bbbe-a2a20c303a5ce952-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=FrFkRwzd-yLuXlIbcwBLZK4Bmc0hkjYKOepA

Source: unknown

DNS traffic detected: queries for: app.box.com

Source: unknown

HTTP traffic detected: POST /client_log HTTP/1.1Host: notes.services.box.comConnection: keep-aliveContent-Length: 132sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"feature-flip-user-id: 0traceparent: 00-daa6e3eb2cd30eb55d6b382acadc290c-298f8b778f85f10f-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Accept: */*csrf-token: 8Zs10sEY-O1hcwY_C6Tlg_vO_BtmFFXYVuLIX-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Origin: https://notes.services.box.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; csrf-token=8Zs10sEY-O1hcwY_C6Tlg_vO_BtmFFXYVuLI; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 173Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:14 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=8DwHjdsF-ibiD77D87sk87pYtnoc41OjNWCk; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 11Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:15 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=JIeeRzbb-zBjX_Q8rRMO9WK5o3eUNm1zu8V8; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 4Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:18 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=Joph68a2-lk4upR6QocxZnNV-qOHzY4UNUkA; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 111Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:31 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCM; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 4Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=5Kll1y7t-UyZv2s_aN0qKuvsKmyQ8LnYc2dY; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 4Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:59 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=1P7G1cYh-A7lsBNrbHSS_vPbvia9gmsk70bE; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 3Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:28:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=niMD7D35-50v9nn8cbaLVjwGueC4BZYooToQ; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 3Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Bold.woff
Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Bold.woff2
Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Regular.woff
Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Regular.woff2

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49805 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@16/64@16/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,17202852564013824410,12512286485433932840,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,17202852564013824410,12512286485433932840,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.112.186.144	notes.services.box.com	United States	33011	BOXNETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.9.103	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
notes.services.box.com	74.112.186.144	true
www.google.com	142.250.9.103	true
app.box.com	74.112.186.144	true
client-log.box.com	74.112.186.144	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
cdn01.boxcdn.net	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0FA	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=p1LXm3ETm1FoJ34uAEtX	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXU&sid=VHklqVsvPnCXiNegAEth	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqyf-&sid=VHklqVsvPnCXiNegAEth	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0WC&sid=VbgVil-Oes1ysG5RAEt6	false	high
https://notes.services.box.com/clientSocketConnectionInfo?fileId=1507423751787&_=1713554823831	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7T7&sid=TxyuYrUuWbg_929aAEuq	false	high
https://notes.services.box.com/clientSocketConnectionInfo?fileId=1507423751787&_=1713554823832	false	high
https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.com	false	high
https://notes.services.box.com/clientSocketConnectionInfo?fileId=1507423751787&_=1713554823833	false	high
https://notes.services.box.com/client_log	false	high
https://notes.services.box.com/ep/pad/diagnosticInfo	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqyg1&sid=VHklqVsvPnCXiNegAEth	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr70_	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0WB&sid=VbgVil-Oes1ysG5RAEt6	false	high
https://app.box.com/notes/1507423751787?s=hiphn6dvy4mquaedfrgoqd500cedhaza	false	high
https://notes.services.box.com/app_init	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyqV&sid=VHklqVsvPnCXiNegAEth	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=VHklqVsvPnCXiNegAEth	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjs&sid=p1LXm3ETm1FoJ34uAEtX	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Be&sid=TxyuYrUuWbg_929aAEuq	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nj&sid=VbgVil-Oes1ysG5RAEt6	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=TxyuYrUuWbg_929aAEuq	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxXJ&sid=p1LXm3ETm1FoJ34uAEtX	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nh&sid=VbgVil-Oes1ysG5RAEt6	false	high
https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza	false	high
https://notes.services.box.com/split-proxy/mySegments/2	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxX2&sid=p1LXm3ETm1FoJ34uAEtX	false	high
https://notes.services.box.com/split-proxy/mySegments/unknown	false	high
https://notes.services.box.com/split-proxy/mySegments/6622c585656315.12660618	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxCK	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjq&sid=p1LXm3ETm1FoJ34uAEtX	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyqR&sid=VHklqVsvPnCXiNegAEth	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXR&sid=VHklqVsvPnCXiNegAEth	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7KL&sid=TxyuYrUuWbg_929aAEuq	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=VbgVil-Oes1ysG5RAEt6	false	high
https://notes.services.box.com/split-proxy/splitChanges?since=-1	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7KN&sid=TxyuYrUuWbg_929aAEuq	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyNh	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Bb&sid=TxyuYrUuWbg_929aAEuq	false	high
https://notes.services.box.com/1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0ej&sid=VbgVil-Oes1ysG5RAEt6	false	high
https://client-log.box.com/analytics-events/	false	high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:27:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	26E2E42CC1170E47D74C5D6998FB3475	365623FAA5DAD26AD88CEFEBA16416C15C0DBE41	F8590BED6437365785F9C2E5B631FC2D5EC75C5FF9E2348AEDA5A7ACC51E4365
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:27:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B308000DC0CF26010C3E93E2E0E7C80F	C093E2F03F44CF83A907146B49631F0E3A86006E	6731A868298EA77F89876149E0869A75BA96539D226C66C414E95EAACBAE2B99
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9DF35D9A12F19D4D2DE594AD3F190EAD	ACAC80D410DD5B8AE8617DD828452BF59FFDDEBF	3CC452446FAC99B2DF2B6E36B051485EAEACE8AC1F0AFCA0B3B560E675CE6BF0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:27:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	06D6C128B5E6618FACFA4FEC467C4A1D	1D026763B6BA003BB03B7AB6874E30F01426AC3A	EFD263837747A8305A6E4982E6E8D12F0C8885CCB8582B3CB585B0A41DD0EA1C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:27:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0540AD633974BF9B6C370DC61CC74402	7CD6849434D4DD405C69ED8CDBBC015B14193F3F	4CA22B50320A431616AC79B762144438E07E0CB96E426E408D8B6322BD37C64F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:27:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	8A1BD6258E3999BEE82545E95000A95A	95F29E7ED1C49F3A166AC56C4C2B827A949E2F4C	E33A418F9AA9EC9A079F7EAA7A10E8F036B9DE869A712BD61D5C0547DBC64A1C
Chrome Cache Entry: 100	SVG Scalable Vector Graphics image	5AA45DEFD7EBE1558D1F57048DA87EE1	8B76F1D206C5D0FD80A370B237B1FDF55FF4E5DB	4C240FFD620AD5DC2BD4DCD52F3D6E14F0C77CC4E419E6670B493DDE2302E395
Chrome Cache Entry: 101	Unicode text, UTF-8 text, with very long lines (52751), with no line terminators	51EEC369503CF284FDB628E0F1A21150	87E9B7CE8CA6DC2C3632956095D6468BB4053198	8BFE7238019E3C4D87E60E2BC55E0E2D290F1BD3B8CD2D17228AF7509E06EF09
Chrome Cache Entry: 102	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	2105BEE9318C22A57F94DD7FE84CF39A	C12BE9DD779AE740753E91A22391EEFA68457C7C	948771AF40F8089DFCEF398D19228B99F70659331E0EB3C67678472683B9929F
Chrome Cache Entry: 103	Unicode text, UTF-8 text, with very long lines (65535), with no line terminators	5CF462FE841E41D831BACB15EB193459	AF64A3031A44AF5B78432A60B14B69D33A6C50DF	C75391943BB1CAF2BA1CA658EAB5975B43A423BF450AFC279F74E683B7DC7FB7
Chrome Cache Entry: 104	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 105	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 106	ASCII text, with no line terminators	37C53670247FD656651CBB50A7116C50	D4F4FE0085C2E8C15EDA0955E8A0562059F0E812	98DD6979DFFCC0205FE53F604C2A96542E5DD391EABF9BEA5D932C9B54566B72
Chrome Cache Entry: 107	JSON data	B2CCD7C11369BCBF8B9C665284CEFDD4	7AF4D314381B8F24F06E4C01013A3E24CF241F36	735F7235E86582B58F8DAE9E394F8044C00707F136CF55C6FE08270E3F74BE65
Chrome Cache Entry: 108	ASCII text, with no line terminators	DE9219E425CC35B85E0FA0222F625269	676F3404E2D750681ECA701EFF3D954F1E4423B4	2D857A3660E0240BAC3AE9F98E2287F46EB6AEBF724775FE130AF2A6C7DFC3C4
Chrome Cache Entry: 72	SVG Scalable Vector Graphics image	5AA45DEFD7EBE1558D1F57048DA87EE1	8B76F1D206C5D0FD80A370B237B1FDF55FF4E5DB	4C240FFD620AD5DC2BD4DCD52F3D6E14F0C77CC4E419E6670B493DDE2302E395
Chrome Cache Entry: 73	ASCII text, with no line terminators	E1B468C52D580BB0C563F7DDAC593474	D41AF16632A19F7BEB11A6471387F576EB3D3BA7	179F1CEA3A0D7D6A99E2A7C10A0B27AE9831C71978051A3EDB0743203DA8C10A
Chrome Cache Entry: 74	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 75	JSON data	8C814C47925E9B2FF056DFA7D3690CC8	4183EC6DCFA17F9BAA7A00977D01B96AC302D801	2070E9EC5EA66461693A174CF782EFA1090E0CA1988968CC1115D019E7B80A95
Chrome Cache Entry: 76	Web Open Font Format (Version 2), TrueType, length 84992, version 2.983	8B1868B7BCE455BF0DA2712EC5D1A6C8	576498905760A76534FEFC8A6A770B643E10AF01	0ABCEFA9EF9546CAD5811B5A32F096F8B9407E43DE385227A78182C32DC3451B
Chrome Cache Entry: 77	JSON data	B2CCD7C11369BCBF8B9C665284CEFDD4	7AF4D314381B8F24F06E4C01013A3E24CF241F36	735F7235E86582B58F8DAE9E394F8044C00707F136CF55C6FE08270E3F74BE65
Chrome Cache Entry: 78	JSON data	8C814C47925E9B2FF056DFA7D3690CC8	4183EC6DCFA17F9BAA7A00977D01B96AC302D801	2070E9EC5EA66461693A174CF782EFA1090E0CA1988968CC1115D019E7B80A95
Chrome Cache Entry: 79	JSON data	69C11BD319B996E56CFA6B5B3BA0C29A	331EF5D3642BD25E49042D545CFAD82B345930DF	668FEC536202AE62E9BA5D68B1568E54974606C9D9AD008439BFEAE2168F7A4B
Chrome Cache Entry: 80	ASCII text, with no line terminators	DE9219E425CC35B85E0FA0222F625269	676F3404E2D750681ECA701EFF3D954F1E4423B4	2D857A3660E0240BAC3AE9F98E2287F46EB6AEBF724775FE130AF2A6C7DFC3C4
Chrome Cache Entry: 81	JSON data	B2CCD7C11369BCBF8B9C665284CEFDD4	7AF4D314381B8F24F06E4C01013A3E24CF241F36	735F7235E86582B58F8DAE9E394F8044C00707F136CF55C6FE08270E3F74BE65
Chrome Cache Entry: 82	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 83	ASCII text, with no line terminators	728A552FDE1B2E387C2B30240D2BFEBC	83DD48BFE3AFEE68F6BDD6109F801EB367D4A76F	C9350A79295E126C749B7E05F7856568B494FF778B9BB09A5C3D57DA469A1839
Chrome Cache Entry: 84	JSON data	B2CCD7C11369BCBF8B9C665284CEFDD4	7AF4D314381B8F24F06E4C01013A3E24CF241F36	735F7235E86582B58F8DAE9E394F8044C00707F136CF55C6FE08270E3F74BE65
Chrome Cache Entry: 85	JSON data	B2CCD7C11369BCBF8B9C665284CEFDD4	7AF4D314381B8F24F06E4C01013A3E24CF241F36	735F7235E86582B58F8DAE9E394F8044C00707F136CF55C6FE08270E3F74BE65
Chrome Cache Entry: 86	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 87	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	2105BEE9318C22A57F94DD7FE84CF39A	C12BE9DD779AE740753E91A22391EEFA68457C7C	948771AF40F8089DFCEF398D19228B99F70659331E0EB3C67678472683B9929F
Chrome Cache Entry: 88	JSON data	B2CCD7C11369BCBF8B9C665284CEFDD4	7AF4D314381B8F24F06E4C01013A3E24CF241F36	735F7235E86582B58F8DAE9E394F8044C00707F136CF55C6FE08270E3F74BE65
Chrome Cache Entry: 89	GIF image data, version 89a, 32 x 16	078DA0AE946B8B0F93E7A519620263B4	A55C769A04123CDD5F0B40EADA86108222EB4C78	B034AF69511E27C742248526B5E3ED0A47E862CB9CC5D18EAD972984A664F388
Chrome Cache Entry: 90	Web Open Font Format (Version 2), TrueType, length 84396, version 2.983	8A54EA1AEB67D07C751BD5F03068317B	CFBEE4F2FD7F359A2A60648BB6797CAC1FD4DA3E	4230A20B841519BDBE4B0C154BAD414E017CF80B3918127D45C4F907EEA07280
Chrome Cache Entry: 91	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 92	GIF image data, version 89a, 32 x 16	078DA0AE946B8B0F93E7A519620263B4	A55C769A04123CDD5F0B40EADA86108222EB4C78	B034AF69511E27C742248526B5E3ED0A47E862CB9CC5D18EAD972984A664F388
Chrome Cache Entry: 93	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 94	ASCII text, with no line terminators	8672D802BB4A0493D39E73BA9D6261B7	0BCB6C17CBD38BC47E95785DBEEE49E799A43131	C507F872DC381ABB17C9CBFF3CBC73241104CC662E5C82224AF019B6A2949ADF
Chrome Cache Entry: 95	ASCII text, with very long lines (1577)	D788F620DAAC96866510DC0A7D9F98AD	8524558C1BA03E37F6E4E8F115A1B2D2D2155B68	9AC94DADD1157C0CF080BE5D444EE2C50285A49863F7212D02CD94B4DE653FA5
Chrome Cache Entry: 96	Unicode text, UTF-8 text, with very long lines (65474), with no line terminators	7E8250DB56CFF1F7D71D910DDEB6B271	AC55571605ED21CC10C43193C2760E7D0BB3B88D	C435971B47F43114516DF13787BB311D36509AAE778898567C599814F26B8BA7
Chrome Cache Entry: 97	JSON data	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9	69E40D8C48A866A84046FD8BD17AF47FF02B79A4	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
Chrome Cache Entry: 98	ASCII text, with very long lines (65451)	C59BE778048F1A5179DF8BD741429A37	D1E974F439569A07D31BEDAA533B0FD64C1430BA	FE6B003A9ADE80729CAFF5BAD800A95346030540C77CE6456EEFFA35FBD444A9
Chrome Cache Entry: 99	JSON data	8C814C47925E9B2FF056DFA7D3690CC8	4183EC6DCFA17F9BAA7A00977D01B96AC302D801	2070E9EC5EA66461693A174CF782EFA1090E0CA1988968CC1115D019E7B80A95

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.com

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49766 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49805 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49766 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91

Source: global traffic	HTTP traffic detected: GET /s/hiphn6dvy4mquaedfrgoqd500cedhaza HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notes/1507423751787?s=hiphn6dvy4mquaedfrgoqd500cedhaza HTTP/1.1Host: app.box.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=9n77r96la30bf8tu33ersii86u; box_visitor_id=6622c585656315.12660618; bv=EUG-6777; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.com HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/unknown HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/splitChanges?since=-1 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /app_init HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/2 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/6622c585656315.12660618 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=wPAHdL1Q-rPHT7izNasLNTCDRvy1katVRBxk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxCK HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-acf20a40200fb9c5b0dab3a41615218b-edaa96f17e2ef07c-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/unknown HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /analytics-events/ HTTP/1.1Host: client-log.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /split-proxy/splitChanges?since=-1 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/2 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /split-proxy/mySegments/6622c585656315.12660618 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2USec-WebSocket-Key: SoLULLVSSFNLBn+nC0nz0Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxXJ&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-4c34e2c983e16ee44fb6aafd6a3da25c-a299f84703e7225a-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxCK HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3P+plw2MLKztap8&MD=wOwOpKc2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjq&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-182e7cf47b8de31275a3a5fb941bd474-e66e5d5d0d14ebcf-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxX2&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqxXJ&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjs&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqxjq&sid=p1LXm3ETm1FoJ34uAEtX HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=Plv5uLxd-X7CJS8fZUouqZCIM6q4mg1jPts8
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823831 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"feature-flip-user-id: 2traceparent: 00-1fca511418f7e6090adf33179d30840c-5bb9effaaf205748-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: Plv5uLxd-X7CJS8fZUouqZCIM6q4mg1jPts8X-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=Plv5uLxd-X7CJS8fZUouqZCIM6q4mg1jPts8
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=RJU9eqWk-ZB4qrwv4Cdu6lCecNxSble7OrgA
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823831 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=fr7pEI5L-SyMLsLBUyINybb81eNjTe-j2Jkc
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyNh HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-b3d41d94e08938e2850f7c58b6f34ef6-7d8eb2cdeef52cc7-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=fr7pEI5L-SyMLsLBUyINybb81eNjTe-j2Jkc
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70gSec-WebSocket-Key: RcUYTgtpirPWvRH1y3iCzg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXU&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-71fc57c9117c0730449d6e3bba7befb2-d77b1c3cfa6542ed-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyNh HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqyf-&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-28d5024e6b1e0ea2aef64a54ed092f99-ee553446eedc5e58-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXR&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=OxtqyXU&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtqyg1&sid=VHklqVsvPnCXiNegAEth HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=6HnnTCYn-Y4RBV9P20pNvvCdZV2hOIWiO70g
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=os04CMgK-r5tt7CqLxQPrmVxhAPdMRbQdsJ8
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823832 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"feature-flip-user-id: 2traceparent: 00-71f3e78d1603052e83302c36e35c5019-329c2d60d7e42223-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: Joph68a2-lk4upR6QocxZnNV-qOHzY4UNUkAX-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=Joph68a2-lk4upR6QocxZnNV-qOHzY4UNUkA
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=VjokEQeC-yBV3ukJgnIrp4a6GWU07CG6BWXk
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823832 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=aKsLTHRm-SK-_oCsSeyBBQmqV5lup5o2QTpw
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0FA HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-8dad3bb5a90c4a233471631e7a1c3160-0af9794f053cd476-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=aKsLTHRm-SK-_oCsSeyBBQmqV5lup5o2QTpw
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0FA HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nj&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-325205831dda6ed9c21e34f8623ad474-e13726f147d2beb0-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCMSec-WebSocket-Key: JRKy8VsRH7t95WCd1/KiFQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nh&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0WB&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-5b4dc8ea67a6beddf39d06bf0a3bf1fa-920aa06126bded7d-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0Nj&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr0WC&sid=VbgVil-Oes1ysG5RAEt6 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=djA4swGz-lKy6QygVL1v5-PSdY-Z7RYNj8UM
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODI1Njk5LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=zSERwLff-yOWNRRDocNzXWgOoITSnFM8hvw4
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3P+plw2MLKztap8&MD=wOwOpKc2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /analytics-events/ HTTP/1.1Host: client-log.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823833 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"feature-flip-user-id: 2traceparent: 00-b091cd5ad75375f2539b0f4e6e67b46f-cdd447714fc7bda1-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: 5Kll1y7t-UyZv2s_aN0qKuvsKmyQ8LnYc2dYX-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; csrf-token=5Kll1y7t-UyZv2s_aN0qKuvsKmyQ8LnYc2dY; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=hRftp0bj-hcCg7ezbtuKnFUrSW23HWTOzYAs
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1507423751787&_=1713554823833 HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fE
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr70_ HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-59c96ba84876b5a2248721c35ccd6bd4-b3a7cb6f1e4f21dc-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fE
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=websocket&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fESec-WebSocket-Key: 6t3Nt6nx38qOxgGA4z1cog==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr70_ HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Be&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-665743357cf98236e6dde7a39e22d4a4-eca199efcb2e514c-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=pu2jHHIF-VyYhUIj4qUZ5TwJ6Quc4RGcv5fE
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Bb&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7Be&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /1001/01/1/2/socket.io/?clientVersion=8.2557.3&EIO=4&transport=polling&t=Oxtr7KL&sid=TxyuYrUuWbg_929aAEuq HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /traceparent: 00-b70f43d5aaea5a21f216b5828690bbbe-a2a20c303a5ce952-00sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1507423751787&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fhiphn6dvy4mquaedfrgoqd500cedhaza&hostname=app.box.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=uNV0DOrH-5pFcQvN6t8E-W3YwJJ5HtLUlxTU
Source: global traffic	HTTP traffic detected: GET /ep/pad/diagnosticInfo HTTP/1.1Host: notes.services.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=6622c585656315.12660618; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=pekqu_fJYk_dT4dzlmq9pujP; express_sid=s%3AR415nGTOF3SM57X8Ao0hm9XiWw9fCXun.QntPjkLzpZeTa%2B2IcpBRkMml%2F3i3vyWnZpkGD%2FGSn7Q; _splunk_rum_sid=%7B%22id%22%3A%22ac87dc4ab181d5bbd9f8b1d88cba8121%22%2C%22startTime%22%3A1713554824669%7D; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjI3YmI0Y2JjLWIwYTUtNGMwNS04OWE4LTlkMThiOTkwZDRjN1IiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNzEzNTU0ODI1Njk3LCJsYXN0RXZlbnRUaW1lIjoxNzEzNTU0ODczMTM0LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=; csrf-token=FrFkRwzd-yLuXlIbcwBLZK4Bmc0hkjYKOepA

Source: unknown

DNS traffic detected: queries for: app.box.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=uJPrgdfo-18NnbGG0kpMObNE_cumXkPeSS2U; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 173Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:14 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=8DwHjdsF-ibiD77D87sk87pYtnoc41OjNWCk; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 11Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:15 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=JIeeRzbb-zBjX_Q8rRMO9WK5o3eUNm1zu8V8; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 4Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:18 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=Joph68a2-lk4upR6QocxZnNV-qOHzY4UNUkA; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 111Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:31 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=gwPhgdxk-gIL_bruOOvZ98MAtYTjzm1EgKCM; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 4Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=5Kll1y7t-UyZv2s_aN0qKuvsKmyQ8LnYc2dY; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 4Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:27:59 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=1P7G1cYh-A7lsBNrbHSS_vPbvia9gmsk70bE; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 3Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 19:28:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 15x-powered-by: Expressset-cookie: csrf-token=niMD7D35-50v9nn8cbaLVjwGueC4BZYooToQ; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"f-Z280BOLXUGgeynAe/z2VTx5EI7Q"x-envoy-upstream-service-time: 3Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Bold.woff
Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Bold.woff2
Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Regular.woff
Source: chromecache_103.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Regular.woff2

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49805 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@16/64@16/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,17202852564013824410,12512286485433932840,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,17202852564013824410,12512286485433932840,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1428925
Product:	CloudBasic
Start time:	21:26:06
Start date:	19.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza