Edit tour

Windows Analysis Report
https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i

Overview

General Information

Sample URL:	https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i
Analysis ID:	830993
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

HTML body contains low number of good links

Invalid T&C link found

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5072 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 1316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1768,i,15355743440405815616,15119586194272472126,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 2344 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_167	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
94194.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
94194.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: https://app.box.com/notes/1164721829413?s=qft12my1l5l17o04knifd8gw776ko70i	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://faxmail-secondary.z13.web.core.windows.net/	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Source: Yara match	File source: 94194.4.pages.csv, type: HTML
Source: Yara match	File source: 94194.6.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_167, type: DROPPED

Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: Number of links: 0
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: Number of links: 0
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: Number of links: 0

Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: Invalid link: Privacy & Cookies
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: Invalid link: Privacy & Cookies
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: Invalid link: Privacy & Cookies

Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: HTML title missing
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: HTML title missing
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: HTML title missing

Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: No <meta name="author".. found
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: No <meta name="author".. found
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: No <meta name="author".. found

Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: No <meta name="copyright".. found
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: No <meta name="copyright".. found
Source: https://faxmail-secondary.z13.web.core.windows.net/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 21:57:45 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9x-powered-by: Expressset-cookie: csrf-token=pv4j98LK-sTVfe-emjGh54u0gzHOptlwvP40; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"x-envoy-upstream-service-time: 422Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 21:57:46 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9x-powered-by: Expressset-cookie: csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; Path=/; Secure; SameSite=Nonestrict-transport-security: max-age=31536000x-frame-options: ALLOW-FROM https://app.box.comcontent-security-policy: frame-ancestors https://app.box.cometag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"x-envoy-upstream-service-time: 598Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close

Source: chromecache_220.1.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_167.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: chromecache_194.1.dr, chromecache_223.1.dr	String found in binary or memory: https://app.box.com/s/821u4wbadx46bwm98ch1k57gcclzy6zt
Source: chromecache_187.1.dr	String found in binary or memory: https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i
Source: chromecache_167.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: chromecache_167.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: chromecache_223.1.dr	String found in binary or memory: https://faxmail-secondary.z13.web.core.windows.net/
Source: chromecache_167.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4iaVI
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4jaVI
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4kaVI
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4saVI
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4taVI
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4uaVI
Source: chromecache_171.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4vaVI
Source: chromecache_181.1.dr, chromecache_190.1.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_224.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_190.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_224.1.dr, chromecache_181.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_167.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: chromecache_167.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: chromecache_167.1.dr	String found in binary or memory: https://spoppe-b.azureedge.net/files/fabric-cdn-prod_20211104.001/assets/item-types/32_2x/docx.png
Source: chromecache_167.1.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: chromecache_167.1.dr	String found in binary or memory: https://youngarsmfg.com/faxmail/postoo.php

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/qft12my1l5l17o04knifd8gw776ko70i HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /notes/1164721829413?s=qft12my1l5l17o04knifd8gw776ko70i HTTP/1.1Host: app.box.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: z=i454dsoktaqf6hrjqimanbghl6; box_visitor_id=6418d6ca5e3329.19175673; bv=OPS-45996; cn=20; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /p/note?fileId=1164721829413&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fqft12my1l5l17o04knifd8gw776ko70i&hostname=app.box.com HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1
Source: global traffic	HTTP traffic detected: GET /app_init?authCode=&fileId=1164721829413&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fqft12my1l5l17o04knifd8gw776ko70i&listId=inbox&_=1679349452464 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"feature-flip-user-id: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: 0pHqRu1Q-AW6GI6VDe6IjMpZpQJMwVmUeZl8X-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; csrf-token=0pHqRu1Q-AW6GI6VDe6IjMpZpQJMwVmUeZl8; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nUa HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=CJV4Xhnu-ZbGz_MhHS_5Lv2FX3MKsddXFTss; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=websocket&sid=lpvWMe6y-UCxux37ALr5 HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=CJV4Xhnu-ZbGz_MhHS_5Lv2FX3MKsddXFTss; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=Sec-WebSocket-Key: fmJGJvwLeeGgkVmH0zMN5g==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nYq&sid=lpvWMe6y-UCxux37ALr5 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=CJV4Xhnu-ZbGz_MhHS_5Lv2FX3MKsddXFTss; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11ndL&sid=lpvWMe6y-UCxux37ALr5 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=CJV4Xhnu-ZbGz_MhHS_5Lv2FX3MKsddXFTss; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /api/v2/auth?users=key HTTP/1.1Host: auth.split.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.22.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aContent-Type: application/jsonAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://notes.services.box.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nue&sid=lpvWMe6y-UCxux37ALr5 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=CJV4Xhnu-ZbGz_MhHS_5Lv2FX3MKsddXFTss; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /clientSocketConnectionInfo?fileId=1164721829413&_=1679349452465 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"feature-flip-user-id: 2sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01csrf-token: CJV4Xhnu-ZbGz_MhHS_5Lv2FX3MKsddXFTssX-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=CJV4Xhnu-ZbGz_MhHS_5Lv2FX3MKsddXFTss; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11opk HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=3n2BNNff-f88yMe25l-tL7S-1U1Ip0ms8VxQ
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=websocket&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://notes.services.box.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=3n2BNNff-f88yMe25l-tL7S-1U1Ip0ms8VxQSec-WebSocket-Key: z/pPhN2448WLvSl+E3oqVQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11ou9&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=3n2BNNff-f88yMe25l-tL7S-1U1Ip0ms8VxQ
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11pEh&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=3n2BNNff-f88yMe25l-tL7S-1U1Ip0ms8VxQ
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11piq&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=3n2BNNff-f88yMe25l-tL7S-1U1Ip0ms8VxQ
Source: global traffic	HTTP traffic detected: GET /box-image?encoding=base64&fileId=1164711816928&fileName=Box%20Notes%20Image%202023-03-14%2021.15.17.png&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2F821u4wbadx46bwm98ch1k57gcclzy6zt&viewContext=inline HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=3n2BNNff-f88yMe25l-tL7S-1U1Ip0ms8VxQ
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11psr&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=3n2BNNff-f88yMe25l-tL7S-1U1Ip0ms8VxQ
Source: global traffic	HTTP traffic detected: GET /box-image?fileId=1164711816928&fileName=Box%20Notes%20Image%202023-03-14%2021.15.17.png&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2F821u4wbadx46bwm98ch1k57gcclzy6zt&viewContext=inline HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=pv4j98LK-sTVfe-emjGh54u0gzHOptlwvP40
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11qbV&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDU0MzE3LCJldmVudElkIjowLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6MX0=; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11sN_&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://faxmail-secondary.z13.web.core.windows.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://faxmail-secondary.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://faxmail-secondary.z13.web.core.windows.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://faxmail-secondary.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://faxmail-secondary.z13.web.core.windows.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://faxmail-secondary.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://faxmail-secondary.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11u9c&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11vxR&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11xjH&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11zUv&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11_GT&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /sse?channels=ODc1NTA5MDQw_MjYwNzIzNzc1MQ%3D%3D_control,ODc1NTA5MDQw_MjYwNzIzNzc1MQ%3D%3D_mySegments,ODc1NTA5MDQw_MjYwNzIzNzc1MQ%3D%3D_splits,%5B%3Foccupancy%3Dmetrics.publishers%5Dcontrol_pri,%5B%3Foccupancy%3Dmetrics.publishers%5Dcontrol_sec&accessToken=eyJhbGciOiJIUzI1NiIsImtpZCI6IkRQVkE3QS44czhnaVEiLCJ0eXAiOiJKV1QifQ.eyJ4LWFibHktY2FwYWJpbGl0eSI6IntcIk9EYzFOVEE1TURRd19Nall3TnpJek56YzFNUT09X2NvbnRyb2xcIjpbXCJzdWJzY3JpYmVcIl0sXCJPRGMxTlRBNU1EUXdfTWpZd056SXpOemMxTVE9PV9teVNlZ21lbnRzXCI6W1wic3Vic2NyaWJlXCJdLFwiT0RjMU5UQTVNRFF3X01qWXdOekl6TnpjMU1RPT1fc3BsaXRzXCI6W1wic3Vic2NyaWJlXCJdLFwiY29udHJvbF9wcmlcIjpbXCJzdWJzY3JpYmVcIixcImNoYW5uZWwtbWV0YWRhdGE6cHVibGlzaGVyc1wiXSxcImNvbnRyb2xfc2VjXCI6W1wic3Vic2NyaWJlXCIsXCJjaGFubmVsLW1ldGFkYXRhOnB1Ymxpc2hlcnNcIl19IiwieC1hYmx5LWNsaWVudElkIjoiY2xpZW50SWQiLCJleHAiOjE2NzkzNTMwNTYsImlhdCI6MTY3OTM0OTQ1Nn0.EU78YDcK7A0PsX0DnaMpjCfsW1yCbec-x3877tb3wnQ&v=1.1&heartbeats=true&SplitSDKVersion=javascript-10.22.3&SplitSDKClientKey=b42a HTTP/1.1Host: streaming.split.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: text/event-streamCache-Control: no-cachesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://notes.services.box.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS1212l&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS122q3&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS124ku&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS126WP&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS128I0&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12A3X&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12BrF&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
Source: global traffic	HTTP traffic detected: GET /3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12DdH&sid=FJ53pnQpy7l_zAfJALr7 HTTP/1.1Host: notes.services.box.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70iAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: box_visitor_id=6418d6ca5e3329.19175673; site_preference=desktop; _notes_oauth_csrf_=1; _csrf=9Jkb_iTh2H9TT0x0eXtm4Usr; express_sid=s%3Ap3GWpWJOpsYrP-20xhjT-4-cNsueMW7i.x7oX7CPcvGzfPM9LZe1RHn9zuxplz2U32vEZALC2ogk; csrf-token=iXEzHntu-WgXR6ZwCjAI7EFS1WJxsmu-iizw; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6IjM1ZWUzNTA3LTU2MTYtNDJlYS05MzZkLWEyNjA1NTlkZGJmNVIiLCJ1c2VySWQiOiIyIiwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjc5MzQ5NDU0MzE1LCJsYXN0RXZlbnRUaW1lIjoxNjc5MzQ5NDY5NTY1LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1768,i,15355743440405815616,15119586194272472126,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1768,i,15355743440405815616,15119586194272472126,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i	0%	Avira URL Cloud	safe
https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i	1%	Virustotal		Browse

Source	Detection	Scanner	Label
https://app.box.com/notes/1164721829413?s=qft12my1l5l17o04knifd8gw776ko70i	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://faxmail-secondary.z13.web.core.windows.net/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://getbootstrap.com)	0%	Avira URL Cloud	safe
https://youngarsmfg.com/faxmail/postoo.php	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
auth.split.io	35.170.228.5	true	false	high
accounts.google.com	142.250.203.109	true	false	high
notes.services.box.com	74.112.186.144	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
www.google.com	142.250.203.100	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
app.box.com	74.112.186.144	true	false	high
client-log.box.com	74.112.186.144	true	false	high
dz87sht31vgqa.cloudfront.net	18.165.183.129	true	false	high
sdk.split.io	unknown	unknown	false	high
cdn01.boxcdn.net	unknown	unknown	false	unknown
clients2.google.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
streaming.split.io	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://notes.services.box.com/client_log	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nUa	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=websocket&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11pEj&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12BrD&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11qbU&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11zUs&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11_GT&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS1212l&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11_GR&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12A3U&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/box-image?encoding=base64&fileId=1164711816928&fileName=Box%20Notes%20Image%202023-03-14%2021.15.17.png&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2F821u4wbadx46bwm98ch1k57gcclzy6zt&viewContext=inline	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=websocket&sid=lpvWMe6y-UCxux37ALr5	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12BrF&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11o1h&sid=lpvWMe6y-UCxux37ALr5	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS1212X&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/p/note?fileId=1164721829413&hostname=app.box.com&sharedLink=https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i	false	SlashNext: Credential Stealing type: Phishing & Social Engineering	high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11opk	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS122q3&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS124ku&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11ou9&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS128I0&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12A3X&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12DdH&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11u9U&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11ou7&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11qbV&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nYq&sid=lpvWMe6y-UCxux37ALr5	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11piq&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11xjD&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nup&sid=lpvWMe6y-UCxux37ALr5	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS12DdG&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/box-image?fileId=1164711816928&fileName=Box%20Notes%20Image%202023-03-14%2021.15.17.png&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2F821u4wbadx46bwm98ch1k57gcclzy6zt&viewContext=inline	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11u9c&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://client-log.box.com/analytics-events/	false		high
https://notes.services.box.com/app_init?authCode=&fileId=1164721829413&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fqft12my1l5l17o04knifd8gw776ko70i&listId=inbox&_=1679349452464	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11psM&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11ndN&sid=lpvWMe6y-UCxux37ALr5	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS126W8&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11zUv&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11ndL&sid=lpvWMe6y-UCxux37ALr5	false		high
https://notes.services.box.com/clientSocketConnectionInfo?fileId=1164721829413&_=1679349452465	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css	false		high
https://app.box.com/notes/1164721829413?s=qft12my1l5l17o04knifd8gw776ko70i	false	SlashNext: Credential Stealing type: Phishing & Social Engineering	high
https://notes.services.box.com/p/note?fileId=1164721829413&sharedLink=https%3A%2F%2Fapp.box.com%2Fs%2Fqft12my1l5l17o04knifd8gw776ko70i&hostname=app.box.com	false		high
https://app.box.com/notes/1164721829413?s=qft12my1l5l17o04knifd8gw776ko70i	false	SlashNext: Credential Stealing type: Phishing & Social Engineering	high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11sN_&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS124km&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11p_u&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11vxR&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11xjH&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://auth.split.io/api/v2/auth?users=key	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS126WP&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nue&sid=lpvWMe6y-UCxux37ALr5	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11psr&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS122q1&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11nYg&sid=lpvWMe6y-UCxux37ALr5	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11pEh&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS11sN-&sid=FJ53pnQpy7l_zAfJALr7	false		high
https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS128Hz&sid=FJ53pnQpy7l_zAfJALr7	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://code.jquery.com/jquery-3.2.1.slim.min.js	chromecache_167.1.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_224.1.dr, chromecache_181.1.dr	false		high
http://opensource.org/licenses/MIT).	chromecache_220.1.dr	false		high
https://app.box.com/s/821u4wbadx46bwm98ch1k57gcclzy6zt	chromecache_194.1.dr, chromecache_223.1.dr	false		high
https://youngarsmfg.com/faxmail/postoo.php	chromecache_167.1.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	chromecache_224.1.dr	false		high
https://getbootstrap.com)	chromecache_181.1.dr, chromecache_190.1.dr	false	Avira URL Cloud: safe	low
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_224.1.dr, chromecache_181.1.dr, chromecache_190.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
74.112.186.144	notes.services.box.com	United States	33011	BOXNETUS	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
18.165.183.129	dz87sht31vgqa.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
35.170.228.5	auth.split.io	United States	14618	AMAZON-AESUS	false
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830993
Start date and time:	2023-03-20 22:56:30 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@29/65@23/12
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://faxmail-secondary.z13.web.core.windows.net/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:X:X
MD5:	C81E728D9D4C2F636F067F89CC14862C
SHA1:	DA4B9237BACCCDF19C0760CAB7AEC4A8359010B0
SHA-256:	D4735E3A265E16EEE03F59718B9B5D03019C07D8B6C51F90DA3A666EEC13AB35
SHA-512:	40B244112641DD78DD4F93B6C9190DD46E0099194D5A44257B7EFAD6EF9FF4683DA1EDA0244448CB343AA688F5D3EFD7314DAFE580AC0BCBF115AECA9E8DC114
Malicious:	false
Reputation:	low
URL:	https://notes.services.box.com/3/9133/3001/socket.io/?clientVersion=8.2297.0&EIO=4&transport=polling&t=OS124ku&sid=FJ53pnQpy7l_zAfJALr7
Preview:	2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 22:57:28.223543882 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:28.223622084 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:28.223697901 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:28.224020958 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:28.224066019 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:28.224128962 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:28.225488901 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:28.225523949 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:28.225812912 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:28.225831032 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:28.300854921 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:28.305565119 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:28.416086912 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:28.418773890 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:28.688447952 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:28.688493967 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:28.688781023 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:28.688810110 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:28.689820051 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:28.689840078 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:28.689915895 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:28.691222906 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:28.691276073 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:28.691307068 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:28.691617012 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:28.691684008 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:28.816339970 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:29.865463018 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:29.865508080 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:29.865792036 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:29.878482103 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:29.878516912 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:29.878703117 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:29.878750086 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:29.878777981 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:29.879770994 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:29.879791021 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:29.914386034 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:29.914478064 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:29.914491892 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:29.914577007 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:29.914622068 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:29.936244965 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:29.936336040 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:29.936362028 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:29.936460972 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:29.936518908 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:29.999846935 CET	49691	443	192.168.2.4	142.250.203.110
Mar 20, 2023 22:57:29.999890089 CET	443	49691	142.250.203.110	192.168.2.4
Mar 20, 2023 22:57:30.005980015 CET	49692	443	192.168.2.4	142.250.203.109
Mar 20, 2023 22:57:30.006031036 CET	443	49692	142.250.203.109	192.168.2.4
Mar 20, 2023 22:57:30.222748995 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.222811937 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.222892046 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.223310947 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.223336935 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.280436039 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.286509991 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.286565065 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.287878990 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.288016081 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.290510893 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.290537119 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.290666103 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.290762901 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.290780067 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.416239977 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.562293053 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.562638044 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.562717915 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.579313993 CET	49694	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.579345942 CET	443	49694	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.581166983 CET	49696	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.581231117 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.581309080 CET	49696	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.581600904 CET	49696	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.581628084 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.628923893 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.629301071 CET	49696	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.629379988 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.629957914 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.630475998 CET	49696	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.630516052 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.630626917 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.631293058 CET	49696	443	192.168.2.4	74.112.186.144
Mar 20, 2023 22:57:30.631321907 CET	443	49696	74.112.186.144	192.168.2.4
Mar 20, 2023 22:57:30.675772905 CET	49697	443	192.168.2.4	142.250.203.100
Mar 20, 2023 22:57:30.675858021 CET	443	49697	142.250.203.100	192.168.2.4
Mar 20, 2023 22:57:30.675967932 CET	49697	443	192.168.2.4	142.250.203.100
Mar 20, 2023 22:57:30.676317930 CET	49697	443	192.168.2.4	142.250.203.100
Mar 20, 2023 22:57:30.676363945 CET	443	49697	142.250.203.100	192.168.2.4
Mar 20, 2023 22:57:30.745980024 CET	443	49697	142.250.203.100	192.168.2.4
Mar 20, 2023 22:57:30.746321917 CET	49697	443	192.168.2.4	142.250.203.100
Mar 20, 2023 22:57:30.746395111 CET	443	49697	142.250.203.100	192.168.2.4
Mar 20, 2023 22:57:30.747941971 CET	443	49697	142.250.203.100	192.168.2.4
Mar 20, 2023 22:57:30.748027086 CET	49697	443	192.168.2.4	142.250.203.100
Mar 20, 2023 22:57:30.750027895 CET	49697	443	192.168.2.4	142.250.203.100
Mar 20, 2023 22:57:30.750051975 CET	443	49697	142.250.203.100	192.168.2.4
Mar 20, 2023 22:57:30.750183105 CET	443	49697	142.250.203.100	192.168.2.4
Mar 20, 2023 22:57:30.919218063 CET	49697	443	192.168.2.4	142.250.203.100

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 22:57:27.837677956 CET	61105	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:27.841536999 CET	56572	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:27.860551119 CET	53	56572	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:27.878730059 CET	53	61105	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:28.695780039 CET	59683	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:28.715701103 CET	53	59683	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:30.021961927 CET	58565	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:30.078434944 CET	53	58565	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:30.614619017 CET	61007	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:30.632097006 CET	53	61007	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:30.640322924 CET	60686	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:30.657645941 CET	53	60686	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:31.079008102 CET	61124	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:31.082591057 CET	59444	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:31.102298021 CET	53	59444	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:34.559154987 CET	61088	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:34.566288948 CET	58729	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:34.585055113 CET	53	61088	8.8.8.8	192.168.2.4
Mar 20, 2023 22:57:34.962992907 CET	56022	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:57:34.982227087 CET	53	56022	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:00.769607067 CET	60998	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:00.791121960 CET	53	60998	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:00.818090916 CET	53370	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:00.820621014 CET	63746	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:00.840478897 CET	64773	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:00.840568066 CET	53	63746	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:00.861360073 CET	53	64773	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:09.234014988 CET	50094	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:09.254298925 CET	53	50094	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:30.672454119 CET	57889	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:30.692554951 CET	53	57889	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:30.696822882 CET	58480	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:30.714416027 CET	53	58480	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:31.444087982 CET	57682	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:31.463792086 CET	53	57682	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:36.348869085 CET	53573	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:58:36.382888079 CET	53	53573	8.8.8.8	192.168.2.4
Mar 20, 2023 22:58:36.654755116 CET	60828	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:59:30.739655018 CET	61610	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:59:30.757890940 CET	53	61610	8.8.8.8	192.168.2.4
Mar 20, 2023 22:59:30.761864901 CET	60291	53	192.168.2.4	8.8.8.8
Mar 20, 2023 22:59:30.779767036 CET	53	60291	8.8.8.8	192.168.2.4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Windows Analysis Report
https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i

Target ID:	0
Start time:	22:57:24
Start date:	20/03/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	22:57:25
Start date:	20/03/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1768,i,15355743440405815616,15119586194272472126,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	2
Start time:	22:57:26
Start date:	20/03/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/qft12my1l5l17o04knifd8gw776ko70i
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre