Edit tour

Windows Analysis Report
https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5

Overview

General Information

Sample URL:	https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5
Analysis ID:	1664836
Infos:

Detection

Score:	0
Range:	0 - 100
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,12184459624570432134,3079195569910240246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=1936,i,12072537486879388997,15279011085792975354,524288 --field-trial-handle=1756,i,9776161172668221715,2789798183340385106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250414-050123.764000 --mojo-platform-channel-handle=2064 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Downloads\Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /jserrors/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=61801&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&pve=1&err=%5B%7B%22params%22:%7B%22stackHash%22:334471766,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22showDisclosureOptions%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20showDisclosureOptions%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:27:22%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:2625%7D%7D%7D,%7B%22params%22:%7B%22stackHash%22:334471760,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22jQuery%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20jQuery%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:21:34%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:2624%7D%7D%7D%5D HTTP/1.1Host: bam.nr-data.netConnection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=68e7260a60b7e390

Source: chromecache_132.1.dr	String found in binary or memory: http://www.employerschoicescreening.com
Source: 6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	String found in binary or memory: http://www.employerschoicescreening.com.
Source: 6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto
Source: 6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkAnkaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBXkaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBnka.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkC3kaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCHkaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCXkaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCnkaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkaHkaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkenkaWzU.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_131.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLAAM9UvI.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLAQM9UvI.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLAgM9UvI.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLAwM9UvI.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLCwM9UvI.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLDAM9UvI.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLDwM9.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19-7DRs5.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-1927DRs5.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-1967DRs5.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19G7DRs5.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19a7DRs5.woff2)
Source: chromecache_130.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19y7DRs5.woff2)
Source: 6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	String found in binary or memory: https://mn.gov/mdhr/yourrights/
Source: 6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	String found in binary or memory: https://www.eeoc.gov/statutes/title-vii-civil-rights-act-1964
Source: 6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	String found in binary or memory: https://www.revisor.mn.gov/statutes/cite/13
Source: 6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	String found in binary or memory: https://www.revisor.mn.gov/statutes/cite/13C

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 64.233.185.106:443 -> 192.168.2.7:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.188.253.192:443 -> 192.168.2.7:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.188.253.192:443 -> 192.168.2.7:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.243.39:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.243.29:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.122.147:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.243.29:443 -> 192.168.2.7:49731 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@43/17@12/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,12184459624570432134,3079195569910240246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=1936,i,12072537486879388997,15279011085792975354,524288 --field-trial-handle=1756,i,9776161172668221715,2789798183340385106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250414-050123.764000 --mojo-platform-channel-handle=2064 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Downloads\Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,12184459624570432134,3079195569910240246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=1936,i,12072537486879388997,15279011085792975354,524288 --field-trial-handle=1756,i,9776161172668221715,2789798183340385106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250414-050123.764000 --mojo-platform-channel-handle=2064 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://www.employerschoicescreening.com	0%	Avira URL Cloud	safe
file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html	0%	Avira URL Cloud	safe
http://www.employerschoicescreening.com.	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
fastly-tls12-bam.nr-data.net	162.247.243.29	true	false	high
b-group.instascreen.net	54.188.253.192	true	false	unknown
js-agent.newrelic.com	162.247.243.39	true	false	high
www.google.com	64.233.185.106	true	false	high
employerschoiceonline.instascreen.net	unknown	unknown	false	high
bam.nr-data.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html	false	Avira URL Cloud: safe	unknown
https://bam.nr-data.net/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=391&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=167&fe=235&dc=191&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657722960,%22n%22:0,%22f%22:6,%22dn%22:6,%22dne%22:6,%22c%22:6,%22ce%22:6,%22rq%22:6,%22rp%22:6,%22rpe%22:9,%22dl%22:90,%22di%22:191,%22ds%22:191,%22de%22:191,%22dc%22:233,%22l%22:233,%22le%22:236%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken	false		high
https://bam.nr-data.net/jserrors/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=60286&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&pve=1&err=%5B%7B%22params%22:%7B%22stackHash%22:334471766,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22showDisclosureOptions%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20showDisclosureOptions%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:27:22%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:1188%7D%7D%7D,%7B%22params%22:%7B%22stackHash%22:334471760,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22jQuery%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20jQuery%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:21:34%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:1187%7D%7D%7D%5D	false		high
https://bam.nr-data.net/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=1788&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=253&fe=1120&dc=1093&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657636331,%22n%22:0,%22f%22:5,%22dn%22:5,%22dne%22:5,%22c%22:5,%22ce%22:5,%22rq%22:5,%22rp%22:5,%22rpe%22:118,%22dl%22:126,%22di%22:1089,%22ds%22:1092,%22de%22:1093,%22dc%22:1119,%22l%22:1119,%22le%22:1121%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken	false		high
https://js-agent.newrelic.com/nr-1044.min.js	false		high
https://bam.nr-data.net/jserrors/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=61801&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&pve=1&err=%5B%7B%22params%22:%7B%22stackHash%22:334471766,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22showDisclosureOptions%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20showDisclosureOptions%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:27:22%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:2625%7D%7D%7D,%7B%22params%22:%7B%22stackHash%22:334471760,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22jQuery%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20jQuery%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:21:34%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:2624%7D%7D%7D%5D	false		high
https://bam.nr-data.net/jserrors/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=61312&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&pve=1&err=%5B%7B%22params%22:%7B%22stackHash%22:334471766,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22showDisclosureOptions%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20showDisclosureOptions%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:27:22%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:1139%7D%7D%7D,%7B%22params%22:%7B%22stackHash%22:334471760,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22jQuery%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20jQuery%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:21:34%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:1138%7D%7D%7D%5D	false		high
https://bam.nr-data.net/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=283&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=78&fe=264&dc=217&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657713925,%22n%22:0,%22f%22:9,%22dn%22:9,%22dne%22:9,%22c%22:9,%22ce%22:9,%22rq%22:9,%22rp%22:9,%22rpe%22:32,%22dl%22:45,%22di%22:213,%22ds%22:213,%22de%22:217,%22dc%22:263,%22l%22:263,%22le%22:264%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken	false		high
https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.eeoc.gov/statutes/title-vii-civil-rights-act-1964	6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	false		high
http://www.employerschoicescreening.com	chromecache_132.1.dr	false	Avira URL Cloud: safe	unknown
http://www.employerschoicescreening.com.	6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	false	Avira URL Cloud: safe	unknown
https://www.revisor.mn.gov/statutes/cite/13C	6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	false		high
https://mn.gov/mdhr/yourrights/	6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	false		high
https://www.revisor.mn.gov/statutes/cite/13	6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp.0.dr, Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload.0.dr, chromecache_132.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.188.253.192	b-group.instascreen.net	United States	16509	AMAZON-02US	false
162.247.243.29	fastly-tls12-bam.nr-data.net	United States	13335	CLOUDFLARENETUS	false
162.247.243.39	js-agent.newrelic.com	United States	13335	CLOUDFLARENETUS	false
64.233.185.106	www.google.com	United States	15169	GOOGLEUS	false
108.177.122.147	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1664836
Start date and time:	2025-04-14 21:06:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@43/17@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.215.102, 172.217.215.101, 172.217.215.113, 172.217.215.138, 172.217.215.139, 172.217.215.100, 172.217.215.94, 172.253.124.84, 74.125.138.113, 74.125.138.100, 74.125.138.139, 74.125.138.101, 74.125.138.102, 74.125.138.138, 173.194.219.102, 173.194.219.138, 173.194.219.100, 173.194.219.101, 173.194.219.139, 173.194.219.113, 108.177.122.100, 108.177.122.102, 108.177.122.138, 108.177.122.113, 108.177.122.139, 108.177.122.101, 64.233.176.95, 64.233.176.94, 23.218.145.145, 74.125.136.101, 74.125.136.138, 74.125.136.113, 74.125.136.102, 74.125.136.139, 74.125.136.100, 142.250.9.94, 142.250.9.138, 142.250.9.101, 142.250.9.113, 142.250.9.102, 142.250.9.139, 142.250.9.100, 64.233.185.94, 172.253.124.101, 172.253.124.139, 172.253.124.100, 172.253.124.138, 172.253.124.113, 172.253.124.102, 142.250.9.84, 74.125.21.100, 74.125.21.101, 74.125.21.139, 74.125.21.138, 74.125.21.102, 74.125.21.113, 172.253.124.94, 74.125.138.94, 142.251.15.94, 4.175.87.197, 23.79.17.61, 172.202.
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text, with very long lines (14785), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	32294
Entropy (8bit):	5.425102287773794
Encrypted:	false
SSDEEP:	384:5bGmRhGjV+3ifEbSaGPc260350RqeJb/QJNhDOLNNZfGSDjnVXy85Dn3LFq:5b2+S8bml350IeJOhDGrto
MD5:	5C27CCCB81AC2D594D826A0F4F4C7D9D
SHA1:	8CA96E29D803868D6731FB388045BAEB148510A5
SHA-256:	90517C924A29C2E37E17208037BEF51C194BFC3E4508D8BB6C2C3FEB3C5D2DAC
SHA-512:	C16C59D292D874DD13E57B1AECBCB793B6E337B9B8960E31AFF4DD9F0347EDF133D7305FA6CEFF463B84BD34E6FA6FA01F3D835D17F339DA79435A685DD7D2DA
Malicious:	false
Reputation:	low
Preview:	..<!DOCTYPE html>..<html lang="en">..<head>..<meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Applicant Authorization Forms</title>. <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">. <script type="text/javascript">.window.NREUM\|\|(NREUM={}),__nr_require=function(t,n,e){function r(e){if(!n[e]){var o=n[e]={exports:{}};t[e][0].call(o.exports,function(n){var o=t[e][1][n];return r(o\|\|n)},o,o.exports)}return n[e].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<e.length;o++)r(e[o]);return r}({1:[function(t,n,e){function r(t){try{s.console&&console.log(t)}catch(n){}}var o,i=t("ee"),a=t(15),s={};try{o=localStorage.getItem("__nr_flags").split(","),console&&"function"==typeof console.log&&(s.console=!0,o.indexOf("dev")!==-1&&(s.dev=!0),o.indexOf("nr_dev")!==-1&&(s.nrDev=!0))}catch(c){}s.nrDev&&i.on("internal-error",function(t){r(t.stack)}),s.dev&&i.on("fn-err",function(t,n,e){r(e.stack)}),s.dev&&(r("NR AGENT IN DEVELOPMENT MODE"),r("fl

C:\Users\user\Downloads\Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text, with very long lines (14785), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	40394
Entropy (8bit):	5.4155417064437845
Encrypted:	false
SSDEEP:	768:5b2+S8bml350IeJOhDGrt5IW0DE5KLv0Dq5KBX0DU5KlHMQMGE:c3JhTW0Q47024BX0A46QS
MD5:	77CDA4937A2722C2950062E30E362D39
SHA1:	28EB59B8FBE915D9BA878D458F578E6F64A17178
SHA-256:	EC606D17CF9795F70E80B5F04A47A24A739E876A31BA648994DB330E8F378907
SHA-512:	2E731F0E921BB7BB399F4B49D39AD4FECF8A74CBA884659B08FD89AF16A2261290BF4EB256B5B236A1242473250991DFCF72DFE1B30EE24B319A491DBD8C777B
Malicious:	false
Reputation:	low
Preview:	..<!DOCTYPE html>..<html lang="en">..<head>..<meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Applicant Authorization Forms</title>. <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">. <script type="text/javascript">.window.NREUM\|\|(NREUM={}),__nr_require=function(t,n,e){function r(e){if(!n[e]){var o=n[e]={exports:{}};t[e][0].call(o.exports,function(n){var o=t[e][1][n];return r(o\|\|n)},o,o.exports)}return n[e].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<e.length;o++)r(e[o]);return r}({1:[function(t,n,e){function r(t){try{s.console&&console.log(t)}catch(n){}}var o,i=t("ee"),a=t(15),s={};try{o=localStorage.getItem("__nr_flags").split(","),console&&"function"==typeof console.log&&(s.console=!0,o.indexOf("dev")!==-1&&(s.dev=!0),o.indexOf("nr_dev")!==-1&&(s.nrDev=!0))}catch(c){}s.nrDev&&i.on("internal-error",function(t){r(t.stack)}),s.dev&&i.on("fn-err",function(t,n,e){r(e.stack)}),s.dev&&(r("NR AGENT IN DEVELOPMENT MODE"),r("fl

C:\Users\user\Downloads\Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text, with very long lines (14785), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	40394
Entropy (8bit):	5.4155417064437845
Encrypted:	false
SSDEEP:	768:5b2+S8bml350IeJOhDGrt5IW0DE5KLv0Dq5KBX0DU5KlHMQMGE:c3JhTW0Q47024BX0A46QS
MD5:	77CDA4937A2722C2950062E30E362D39
SHA1:	28EB59B8FBE915D9BA878D458F578E6F64A17178
SHA-256:	EC606D17CF9795F70E80B5F04A47A24A739E876A31BA648994DB330E8F378907
SHA-512:	2E731F0E921BB7BB399F4B49D39AD4FECF8A74CBA884659B08FD89AF16A2261290BF4EB256B5B236A1242473250991DFCF72DFE1B30EE24B319A491DBD8C777B
Malicious:	false
Reputation:	low
Preview:	..<!DOCTYPE html>..<html lang="en">..<head>..<meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Applicant Authorization Forms</title>. <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">. <script type="text/javascript">.window.NREUM\|\|(NREUM={}),__nr_require=function(t,n,e){function r(e){if(!n[e]){var o=n[e]={exports:{}};t[e][0].call(o.exports,function(n){var o=t[e][1][n];return r(o\|\|n)},o,o.exports)}return n[e].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<e.length;o++)r(e[o]);return r}({1:[function(t,n,e){function r(t){try{s.console&&console.log(t)}catch(n){}}var o,i=t("ee"),a=t(15),s={};try{o=localStorage.getItem("__nr_flags").split(","),console&&"function"==typeof console.log&&(s.console=!0,o.indexOf("dev")!==-1&&(s.dev=!0),o.indexOf("nr_dev")!==-1&&(s.nrDev=!0))}catch(c){}s.nrDev&&i.on("internal-error",function(t){r(t.stack)}),s.dev&&i.on("fn-err",function(t,n,e){r(e.stack)}),s.dev&&(r("NR AGENT IN DEVELOPMENT MODE"),r("fl

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	87
Entropy (8bit):	4.05298175485356
Encrypted:	false
SSDEEP:	3:U3KTDW3MiLLUHcjVXlVBT7PCcfn:H6NLgHWXZT7PCcfn
MD5:	5151B02BBED24D56CBE862FE7462084D
SHA1:	6ACAB31C3D18D3E61309E8B46338CF8BC4D67EEC
SHA-256:	300735AC477BB7E09CE2725F0031B085E5C86F09903D053AC8E44596731D8780
SHA-512:	BF09D8D9D0DFBE00FD38D3BEF695FA70CD9EB64BB629F475CB5BBF7889F866D1F9626DDBC84927020735F8FC0B4236206A7A5CA837368126D92C30ECDAED32C6
Malicious:	false
Reputation:	low
URL:	"https://bam.nr-data.net/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=283&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=78&fe=264&dc=217&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657713925,%22n%22:0,%22f%22:9,%22dn%22:9,%22dne%22:9,%22c%22:9,%22ce%22:9,%22rq%22:9,%22rp%22:9,%22rpe%22:32,%22dl%22:45,%22di%22:213,%22ds%22:213,%22de%22:217,%22dc%22:263,%22l%22:263,%22le%22:264%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken"
Preview:	NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0,'log':0})

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	87
Entropy (8bit):	4.05298175485356
Encrypted:	false
SSDEEP:	3:U3KTDW3MiLLUHcjVXlVBT7PCcfn:H6NLgHWXZT7PCcfn
MD5:	5151B02BBED24D56CBE862FE7462084D
SHA1:	6ACAB31C3D18D3E61309E8B46338CF8BC4D67EEC
SHA-256:	300735AC477BB7E09CE2725F0031B085E5C86F09903D053AC8E44596731D8780
SHA-512:	BF09D8D9D0DFBE00FD38D3BEF695FA70CD9EB64BB629F475CB5BBF7889F866D1F9626DDBC84927020735F8FC0B4236206A7A5CA837368126D92C30ECDAED32C6
Malicious:	false
Reputation:	low
URL:	"https://bam.nr-data.net/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=391&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=167&fe=235&dc=191&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657722960,%22n%22:0,%22f%22:6,%22dn%22:6,%22dne%22:6,%22c%22:6,%22ce%22:6,%22rq%22:6,%22rp%22:6,%22rpe%22:9,%22dl%22:90,%22di%22:191,%22ds%22:191,%22de%22:191,%22dc%22:233,%22l%22:233,%22le%22:236%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken"
Preview:	NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0,'log':0})

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	87
Entropy (8bit):	4.05298175485356
Encrypted:	false
SSDEEP:	3:U3KTDW3MiLLUHcjVXlVBT7PCcfn:H6NLgHWXZT7PCcfn
MD5:	5151B02BBED24D56CBE862FE7462084D
SHA1:	6ACAB31C3D18D3E61309E8B46338CF8BC4D67EEC
SHA-256:	300735AC477BB7E09CE2725F0031B085E5C86F09903D053AC8E44596731D8780
SHA-512:	BF09D8D9D0DFBE00FD38D3BEF695FA70CD9EB64BB629F475CB5BBF7889F866D1F9626DDBC84927020735F8FC0B4236206A7A5CA837368126D92C30ECDAED32C6
Malicious:	false
Reputation:	low
URL:	"https://bam.nr-data.net/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=1788&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=253&fe=1120&dc=1093&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657636331,%22n%22:0,%22f%22:5,%22dn%22:5,%22dne%22:5,%22c%22:5,%22ce%22:5,%22rq%22:5,%22rp%22:5,%22rpe%22:118,%22dl%22:126,%22di%22:1089,%22ds%22:1092,%22de%22:1093,%22dc%22:1119,%22l%22:1119,%22le%22:1121%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken"
Preview:	NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0,'log':0})

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22890), with no line terminators
Category:	downloaded
Size (bytes):	22890
Entropy (8bit):	5.299497896298777
Encrypted:	false
SSDEEP:	384:yWe9x8LHvWgIdGYwNRUyqK3zqdPEliwbiki5IYrQXFFPXXRbS7gQhs:yWzeg0GYwNHoprBQVBt/Qhs
MD5:	6442AAA45EC28F8B2C541026F3C24871
SHA1:	32DC677BB3FA61736A35D30A809AA1C4A0A04976
SHA-256:	574558BC99CBCC4C8A0E57519CB6A317A0A4E0B70094FBEC41946138D576486B
SHA-512:	A158F255F94883CEA48CEE91A343946A5F1B04EC56764EAC0B9E4D478E48B34EBC24FC261E4A6D10F71928513E938CD9D8029A860187ADABAAAF19C4BD45834F
Malicious:	false
Reputation:	low
URL:	https://js-agent.newrelic.com/nr-1044.min.js
Preview:	!function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var a="function"==typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return o(t,!0);throw new Error("Cannot find module '"+t+"'")}var s=e[t]={exports:{}};n[t][0].call(s.exports,function(e){var o=n[t][1][e];return r(o\|\|e)},s,s.exports)}return e[t].exports}for(var o="function"==typeof __nr_require&&__nr_require,i=0;i<t.length;i++)r(t[i]);return r}({1:[function(n,e,t){e.exports=function(n,e){return"addEventListener"in window?addEventListener(n,e,!1):"attachEvent"in window?attachEvent("on"+n,e):void 0}},{}],2:[function(n,e,t){function r(n,e,t,r){l("bstAgg",[n,e,t,r]),p[n]\|\|(p[n]={});var i=p[n][e];return i\|\|(i=p[n][e]={params:t\|\|{}}),i.metrics=o(r,i.metrics),i}function o(n,e){return e\|\|(e={count:0}),e.count+=1,f(n,function(n,t){e[n]=i(t,e[n])}),e}function i(n,e){return e?(e&&!e.c&&(e={t:e.t,min:e.t,max:e.t,sos:e.te.t,c:1}),e.c+=1,e.t+=n,e.sos+=nn,n>e.max&&(e.max=n),n<e.min&&(e.min=n),e):{t:n}}function a(n,e){return e?p[n]&&p

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	14724
Entropy (8bit):	5.49602855764709
Encrypted:	false
SSDEEP:	384:fihPi6ifiyyiUiAi7FhPF6FfFyyFUFAF7vhPv6vfvyyvUvAvhneVn9VnznQun4na:aU5a03DJnWdHkQj9gHdKGhy9VzF4zFVq
MD5:	519DFEEC1A1CDD1EEF8F2201090BE675
SHA1:	22A84DBCB69DD399F3726B80858B38C264DFCBAD
SHA-256:	4ED63316CE7E7B844D78B0CB329A687CCEF90CB40E1E2A9AE093B2EB8A98E9FE
SHA-512:	83F63836370D0901C0E211540DBF9D321D32044BA0A7E8651D10A33010588512431316D6642ECB5532256478BD365511F8766903190FB57F84C1B1FD07A0B739
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Roboto+Condensed:400,400italic,500,500italic,700,700italic"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto Condensed';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLAgM9UvI.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto Condensed';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLCwM9UvI.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto Condensed';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLAwM9UvI.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto Condensed';. font-style: italic;. font-weight: 400;. src: url(

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	32400
Entropy (8bit):	5.274095985994467
Encrypted:	false
SSDEEP:	768:VTFGjLEN9RxxoaR4LfNSGm3SwXiL5No8c5NSpbJfai0Ydi9+QJEaNPDz4T06JOaH:uv7L2md
MD5:	9F8EC6F16D15D42A47DBF12A9CBDCC28
SHA1:	B5CC52FE2329E19B94EDEE8610F630A112711DD0
SHA-256:	3B77B94E6A5AB4E9D345C74F10AAD3B6F057D7F777F91AC92273040F5B4639DF
SHA-512:	9AB82B5B4956FDDB01234F8B486B831CB5DA17712EEE3186B6A63238DBD191D672D324C9254A4EFC1C12DBB1D3C1269CA5A0FE9453D3A6EFC76C6F60EC82F9AA
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Roboto:400,400italic,500,500italic,700,700italic"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkC3kaWzU.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkAnkaWzU.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCnkaWzU.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 400;.

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text, with very long lines (14785), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	40394
Entropy (8bit):	5.4155417064437845
Encrypted:	false
SSDEEP:	768:5b2+S8bml350IeJOhDGrt5IW0DE5KLv0Dq5KBX0DU5KlHMQMGE:c3JhTW0Q47024BX0A46QS
MD5:	77CDA4937A2722C2950062E30E362D39
SHA1:	28EB59B8FBE915D9BA878D458F578E6F64A17178
SHA-256:	EC606D17CF9795F70E80B5F04A47A24A739E876A31BA648994DB330E8F378907
SHA-512:	2E731F0E921BB7BB399F4B49D39AD4FECF8A74CBA884659B08FD89AF16A2261290BF4EB256B5B236A1242473250991DFCF72DFE1B30EE24B319A491DBD8C777B
Malicious:	false
Reputation:	low
URL:	https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5
Preview:	..<!DOCTYPE html>..<html lang="en">..<head>..<meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Applicant Authorization Forms</title>. <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">. <script type="text/javascript">.window.NREUM\|\|(NREUM={}),__nr_require=function(t,n,e){function r(e){if(!n[e]){var o=n[e]={exports:{}};t[e][0].call(o.exports,function(n){var o=t[e][1][n];return r(o\|\|n)},o,o.exports)}return n[e].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<e.length;o++)r(e[o]);return r}({1:[function(t,n,e){function r(t){try{s.console&&console.log(t)}catch(n){}}var o,i=t("ee"),a=t(15),s={};try{o=localStorage.getItem("__nr_flags").split(","),console&&"function"==typeof console.log&&(s.console=!0,o.indexOf("dev")!==-1&&(s.dev=!0),o.indexOf("nr_dev")!==-1&&(s.nrDev=!0))}catch(c){}s.nrDev&&i.on("internal-error",function(t){r(t.stack)}),s.dev&&i.on("fn-err",function(t,n,e){r(e.stack)}),s.dev&&(r("NR AGENT IN DEVELOPMENT MODE"),r("fl

Static File Info

⊘No static file info

File Icon


Icon Hash:	00b29a8e86828200

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 145
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 14, 2025 21:07:06.684566021 CEST	49675	443	192.168.2.7	2.23.227.208
Apr 14, 2025 21:07:06.684571981 CEST	49673	443	192.168.2.7	2.23.227.208
Apr 14, 2025 21:07:06.684830904 CEST	49674	443	192.168.2.7	2.23.227.208
Apr 14, 2025 21:07:08.559607029 CEST	49676	80	192.168.2.7	23.199.215.203
Apr 14, 2025 21:07:08.559633970 CEST	49677	443	192.168.2.7	2.18.98.62
Apr 14, 2025 21:07:13.436589003 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:13.436646938 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:13.436744928 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:13.436913013 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:13.436928034 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:13.658379078 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:13.658473015 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:13.659785986 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:13.659795046 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:13.660039902 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:13.702253103 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:14.873430014 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:14.873466015 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:14.873605967 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:14.873847961 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:14.873872042 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:14.874144077 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:14.874186993 CEST	443	49693	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:14.874243975 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:14.874411106 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:14.874425888 CEST	443	49693	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.398718119 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.398732901 CEST	443	49693	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.398803949 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.398817062 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.400082111 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.400091887 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.400346994 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.400496960 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.400501966 CEST	443	49693	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.400746107 CEST	443	49693	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.400779963 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.448271036 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.453353882 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.792546988 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792599916 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792642117 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792680025 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.792701960 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792726994 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.792752028 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.792777061 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792886972 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792924881 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792954922 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.792964935 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.792994022 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.835500002 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.835623980 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.835638046 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.835654974 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:15.835700989 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.837848902 CEST	49692	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:07:15.837869883 CEST	443	49692	54.188.253.192	192.168.2.7
Apr 14, 2025 21:07:16.297678947 CEST	49675	443	192.168.2.7	2.23.227.208
Apr 14, 2025 21:07:16.297698021 CEST	49674	443	192.168.2.7	2.23.227.208
Apr 14, 2025 21:07:16.299949884 CEST	49673	443	192.168.2.7	2.23.227.208
Apr 14, 2025 21:07:18.414048910 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.414098978 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.414211035 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.414372921 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.414388895 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.638545990 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.638880968 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.721211910 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.721235037 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.721596003 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.725111961 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.772279978 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.844610929 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.844682932 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.844732046 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.844772100 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.844803095 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.844810963 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.844827890 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.844878912 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.844878912 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.848057032 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.851581097 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.851619005 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.851768017 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.851784945 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.851923943 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.855129957 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.858705997 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.858767986 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.858783960 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.862214088 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.862312078 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.862421989 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.862435102 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.862485886 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.865777016 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.866019964 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:18.866103888 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.964979887 CEST	49702	443	192.168.2.7	162.247.243.39
Apr 14, 2025 21:07:18.965003014 CEST	443	49702	162.247.243.39	192.168.2.7
Apr 14, 2025 21:07:19.080976963 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.081042051 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.081171036 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.081374884 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.081391096 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.425316095 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.425375938 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.426553011 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.426563978 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.426796913 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.427021980 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.472276926 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.801842928 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.802002907 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:19.802078009 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.802927017 CEST	49703	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:07:19.802942991 CEST	443	49703	162.247.243.29	192.168.2.7
Apr 14, 2025 21:07:23.662071943 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:23.662132978 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:23.662220001 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:23.782200098 CEST	49691	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:07:23.782224894 CEST	443	49691	64.233.185.106	192.168.2.7
Apr 14, 2025 21:07:35.811039925 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 14, 2025 21:07:36.123166084 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 14, 2025 21:07:36.732557058 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 14, 2025 21:07:37.935688019 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 14, 2025 21:07:40.341871977 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 14, 2025 21:07:44.373079062 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 14, 2025 21:07:44.685070992 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 14, 2025 21:07:45.169538021 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 14, 2025 21:07:45.294543028 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 14, 2025 21:07:46.497673035 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 14, 2025 21:07:48.904062986 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 14, 2025 21:07:53.716389894 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 14, 2025 21:07:54.779031038 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 14, 2025 21:08:00.403878927 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:08:00.403892994 CEST	443	49693	54.188.253.192	192.168.2.7
Apr 14, 2025 21:08:03.325990915 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 14, 2025 21:08:13.391452074 CEST	49718	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:08:13.391484976 CEST	443	49718	64.233.185.106	192.168.2.7
Apr 14, 2025 21:08:13.391552925 CEST	49718	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:08:13.391779900 CEST	49718	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:08:13.391793013 CEST	443	49718	64.233.185.106	192.168.2.7
Apr 14, 2025 21:08:13.614011049 CEST	443	49718	64.233.185.106	192.168.2.7
Apr 14, 2025 21:08:13.614331961 CEST	49718	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:08:13.614362955 CEST	443	49718	64.233.185.106	192.168.2.7
Apr 14, 2025 21:08:15.796595097 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:08:15.796679020 CEST	443	49693	54.188.253.192	192.168.2.7
Apr 14, 2025 21:08:15.796736956 CEST	49693	443	192.168.2.7	54.188.253.192
Apr 14, 2025 21:08:18.984838963 CEST	49721	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:18.984880924 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:18.984952927 CEST	49721	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:18.985169888 CEST	49721	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:18.985182047 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:19.201817036 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:19.202117920 CEST	49721	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:19.202136040 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:19.202282906 CEST	49721	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:19.202291012 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:19.451106071 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:19.451229095 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:19.451484919 CEST	49721	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:19.451745987 CEST	49721	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:19.451759100 CEST	443	49721	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:23.624814987 CEST	443	49718	64.233.185.106	192.168.2.7
Apr 14, 2025 21:08:23.624888897 CEST	443	49718	64.233.185.106	192.168.2.7
Apr 14, 2025 21:08:23.625125885 CEST	49718	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:08:23.797590017 CEST	49718	443	192.168.2.7	64.233.185.106
Apr 14, 2025 21:08:23.797609091 CEST	443	49718	64.233.185.106	192.168.2.7
Apr 14, 2025 21:08:32.028990030 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:32.029051065 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:32.029122114 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:32.029261112 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:32.029272079 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:32.245663881 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:32.245738983 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:32.247006893 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:32.247020006 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:32.247302055 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:32.295097113 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:35.172131062 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.172183037 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.172364950 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.172636032 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.172651052 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.507371902 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.507436037 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.556257963 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.556298018 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.556626081 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.557847023 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.600267887 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.958425045 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.958528996 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:35.958667994 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.960150003 CEST	49731	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:35.960166931 CEST	443	49731	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:42.244541883 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:42.244601965 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:42.244699955 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:43.930583954 CEST	49729	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:08:43.930633068 CEST	443	49729	108.177.122.147	192.168.2.7
Apr 14, 2025 21:08:44.214200974 CEST	49735	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:44.214255095 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:44.214509964 CEST	49735	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:44.215070009 CEST	49735	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:44.215084076 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:44.550348997 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:44.558017015 CEST	49735	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:44.558044910 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:44.558386087 CEST	49735	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:44.558392048 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:44.944649935 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:44.944798946 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:08:44.944896936 CEST	49735	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:44.946176052 CEST	49735	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:08:44.946193933 CEST	443	49735	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:31.984513044 CEST	49739	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:09:31.984561920 CEST	443	49739	108.177.122.147	192.168.2.7
Apr 14, 2025 21:09:31.985085011 CEST	49739	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:09:31.985085011 CEST	49739	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:09:31.985120058 CEST	443	49739	108.177.122.147	192.168.2.7
Apr 14, 2025 21:09:32.201858997 CEST	443	49739	108.177.122.147	192.168.2.7
Apr 14, 2025 21:09:32.202332973 CEST	49739	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:09:32.202358961 CEST	443	49739	108.177.122.147	192.168.2.7
Apr 14, 2025 21:09:35.064762115 CEST	49741	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:35.064816952 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:35.064918041 CEST	49741	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:35.065080881 CEST	49741	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:35.065094948 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:35.281280041 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:35.281740904 CEST	49741	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:35.281763077 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:35.282030106 CEST	49741	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:35.282036066 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:35.528923988 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:35.529053926 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:35.529580116 CEST	49741	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:35.529779911 CEST	49741	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:35.529794931 CEST	443	49741	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:42.200661898 CEST	443	49739	108.177.122.147	192.168.2.7
Apr 14, 2025 21:09:42.200740099 CEST	443	49739	108.177.122.147	192.168.2.7
Apr 14, 2025 21:09:42.200824022 CEST	49739	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:09:44.021806955 CEST	49739	443	192.168.2.7	108.177.122.147
Apr 14, 2025 21:09:44.021852016 CEST	443	49739	108.177.122.147	192.168.2.7
Apr 14, 2025 21:09:45.125708103 CEST	49745	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:45.125771046 CEST	443	49745	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:45.125916004 CEST	49745	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:45.126091003 CEST	49745	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:45.126110077 CEST	443	49745	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:45.344769955 CEST	443	49745	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:45.345077038 CEST	49745	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:45.345115900 CEST	443	49745	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:45.345365047 CEST	49745	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:45.345372915 CEST	443	49745	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:45.604837894 CEST	443	49745	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:45.604991913 CEST	443	49745	162.247.243.29	192.168.2.7
Apr 14, 2025 21:09:45.605040073 CEST	49745	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:45.605557919 CEST	49745	443	192.168.2.7	162.247.243.29
Apr 14, 2025 21:09:45.605575085 CEST	443	49745	162.247.243.29	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 14, 2025 21:07:08.769221067 CEST	53	61767	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:08.991539955 CEST	53	65050	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:09.843553066 CEST	53	51275	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:09.888768911 CEST	53	55036	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:13.328639030 CEST	62782	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:13.328958988 CEST	61155	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:13.435421944 CEST	53	61155	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:13.435569048 CEST	53	62782	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:14.715353966 CEST	52839	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:14.715631962 CEST	61129	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:14.871109009 CEST	53	61129	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:14.872678041 CEST	53	52839	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:17.511733055 CEST	53	61082	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:18.306637049 CEST	50180	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:18.306934118 CEST	53100	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:18.413413048 CEST	53	53100	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:18.413434029 CEST	53	50180	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:18.973704100 CEST	57313	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:18.974118948 CEST	62691	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:07:19.080231905 CEST	53	62691	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:19.080323935 CEST	53	57313	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:26.987896919 CEST	53	54794	1.1.1.1	192.168.2.7
Apr 14, 2025 21:07:45.668445110 CEST	53	64070	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:08.090332985 CEST	53	53304	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:08.671926022 CEST	53	54850	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:11.779267073 CEST	53	51042	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:27.381901026 CEST	53	52146	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:27.454116106 CEST	53	55200	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:28.057846069 CEST	53	60822	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:31.921524048 CEST	54158	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:08:31.921750069 CEST	55444	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:08:32.027864933 CEST	53	54158	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:32.027893066 CEST	53	55444	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:35.063652992 CEST	59639	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:08:35.063950062 CEST	53107	53	192.168.2.7	1.1.1.1
Apr 14, 2025 21:08:35.170418978 CEST	53	59639	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:35.170514107 CEST	53	53107	1.1.1.1	192.168.2.7
Apr 14, 2025 21:08:41.115115881 CEST	138	138	192.168.2.7	192.168.2.255
Apr 14, 2025 21:08:45.048794031 CEST	53	50141	1.1.1.1	192.168.2.7
Apr 14, 2025 21:09:03.920376062 CEST	53	63139	1.1.1.1	192.168.2.7
Apr 14, 2025 21:09:26.700373888 CEST	53	53974	1.1.1.1	192.168.2.7
Apr 14, 2025 21:09:27.219954014 CEST	53	53228	1.1.1.1	192.168.2.7
Apr 14, 2025 21:09:30.372035027 CEST	53	49709	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 14, 2025 21:07:09.842083931 CEST	192.168.2.7	1.1.1.1	c24c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 14, 2025 21:07:13.328639030 CEST	192.168.2.7	1.1.1.1	0x6913	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:13.328958988 CEST	192.168.2.7	1.1.1.1	0x219e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 14, 2025 21:07:14.715353966 CEST	192.168.2.7	1.1.1.1	0xa2e1	Standard query (0)	employerschoiceonline.instascreen.net	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:14.715631962 CEST	192.168.2.7	1.1.1.1	0x737d	Standard query (0)	employerschoiceonline.instascreen.net	65	IN (0x0001)	false
Apr 14, 2025 21:07:18.306637049 CEST	192.168.2.7	1.1.1.1	0x922c	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:18.306934118 CEST	192.168.2.7	1.1.1.1	0x6126	Standard query (0)	js-agent.newrelic.com	65	IN (0x0001)	false
Apr 14, 2025 21:07:18.973704100 CEST	192.168.2.7	1.1.1.1	0x622e	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:18.974118948 CEST	192.168.2.7	1.1.1.1	0x77a3	Standard query (0)	bam.nr-data.net	65	IN (0x0001)	false
Apr 14, 2025 21:08:31.921524048 CEST	192.168.2.7	1.1.1.1	0x4798	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:31.921750069 CEST	192.168.2.7	1.1.1.1	0xe559	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 14, 2025 21:08:35.063652992 CEST	192.168.2.7	1.1.1.1	0x7477	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:35.063950062 CEST	192.168.2.7	1.1.1.1	0x3899	Standard query (0)	bam.nr-data.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 14, 2025 21:07:13.435421944 CEST	1.1.1.1	192.168.2.7	0x219e	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 14, 2025 21:07:13.435569048 CEST	1.1.1.1	192.168.2.7	0x6913	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:13.435569048 CEST	1.1.1.1	192.168.2.7	0x6913	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:13.435569048 CEST	1.1.1.1	192.168.2.7	0x6913	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:13.435569048 CEST	1.1.1.1	192.168.2.7	0x6913	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:13.435569048 CEST	1.1.1.1	192.168.2.7	0x6913	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:13.435569048 CEST	1.1.1.1	192.168.2.7	0x6913	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:14.871109009 CEST	1.1.1.1	192.168.2.7	0x737d	No error (0)	employerschoiceonline.instascreen.net	b-group.instascreen.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:07:14.872678041 CEST	1.1.1.1	192.168.2.7	0xa2e1	No error (0)	employerschoiceonline.instascreen.net	b-group.instascreen.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:07:14.872678041 CEST	1.1.1.1	192.168.2.7	0xa2e1	No error (0)	b-group.instascreen.net		54.188.253.192	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:14.872678041 CEST	1.1.1.1	192.168.2.7	0xa2e1	No error (0)	b-group.instascreen.net		44.240.253.46	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:14.872678041 CEST	1.1.1.1	192.168.2.7	0xa2e1	No error (0)	b-group.instascreen.net		54.186.209.228	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:18.413434029 CEST	1.1.1.1	192.168.2.7	0x922c	No error (0)	js-agent.newrelic.com		162.247.243.39	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:07:19.080231905 CEST	1.1.1.1	192.168.2.7	0x77a3	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:07:19.080231905 CEST	1.1.1.1	192.168.2.7	0x77a3	No error (0)	bam.cell.nr-data.net	fastly-tls12-bam.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:07:19.080323935 CEST	1.1.1.1	192.168.2.7	0x622e	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:07:19.080323935 CEST	1.1.1.1	192.168.2.7	0x622e	No error (0)	bam.cell.nr-data.net	fastly-tls12-bam.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:07:19.080323935 CEST	1.1.1.1	192.168.2.7	0x622e	No error (0)	fastly-tls12-bam.nr-data.net		162.247.243.29	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:32.027864933 CEST	1.1.1.1	192.168.2.7	0x4798	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:32.027864933 CEST	1.1.1.1	192.168.2.7	0x4798	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:32.027864933 CEST	1.1.1.1	192.168.2.7	0x4798	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:32.027864933 CEST	1.1.1.1	192.168.2.7	0x4798	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:32.027864933 CEST	1.1.1.1	192.168.2.7	0x4798	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:32.027864933 CEST	1.1.1.1	192.168.2.7	0x4798	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:32.027893066 CEST	1.1.1.1	192.168.2.7	0xe559	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 14, 2025 21:08:35.170418978 CEST	1.1.1.1	192.168.2.7	0x7477	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:08:35.170418978 CEST	1.1.1.1	192.168.2.7	0x7477	No error (0)	bam.cell.nr-data.net	fastly-tls12-bam.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:08:35.170418978 CEST	1.1.1.1	192.168.2.7	0x7477	No error (0)	fastly-tls12-bam.nr-data.net		162.247.243.29	A (IP address)	IN (0x0001)	false
Apr 14, 2025 21:08:35.170514107 CEST	1.1.1.1	192.168.2.7	0x3899	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 14, 2025 21:08:35.170514107 CEST	1.1.1.1	192.168.2.7	0x3899	No error (0)	bam.cell.nr-data.net	fastly-tls12-bam.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

employerschoiceonline.instascreen.net

js-agent.newrelic.com

bam.nr-data.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49692	54.188.253.192	443	5416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:07:15 UTC	785	OUT	GET /quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5 HTTP/1.1 Host: employerschoiceonline.instascreen.net Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 19:07:15 UTC	884	IN	HTTP/1.1 200 Date: Mon, 14 Apr 2025 19:07:15 GMT Content-Type: text/html;charset=ISO-8859-1 Transfer-Encoding: chunked Connection: close Set-Cookie: AWSALB=ZRgYTCo2ORzSFZ7ZJCClP5IrsPYscVoTps6Cix+9ZmGBKTpKrl0NH8dZUAO2Wi4JX/c0/uVovoZIhGuLl2sV0S3XweMEJmlGKXtgyH7GrugZt1v5WLDwKQTAAopR; Expires=Mon, 21 Apr 2025 19:07:15 GMT; Path=/ Set-Cookie: AWSALBCORS=ZRgYTCo2ORzSFZ7ZJCClP5IrsPYscVoTps6Cix+9ZmGBKTpKrl0NH8dZUAO2Wi4JX/c0/uVovoZIhGuLl2sV0S3XweMEJmlGKXtgyH7GrugZt1v5WLDwKQTAAopR; Expires=Mon, 21 Apr 2025 19:07:15 GMT; Path=/; SameSite=None; Secure Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Pragma: no-store Content-Disposition: attachment; filename=Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html Set-Cookie: SESSION=ZGEzZWRlYTctMjg3Zi00ZmUwLWI0YWEtZGZlMGUzYzdmYmEx; Path=/; Secure; HttpOnly; SameSite=None vary: accept-encoding Server: MMXX
2025-04-14 19:07:15 UTC	15500	IN	Data Raw: 33 65 32 63 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 41 70 70 6c 69 63 61 6e 74 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 46 6f 72 6d 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a Data Ascii: 3e2c<!DOCTYPE html><html lang="en"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Applicant Authorization Forms</title> <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"> <script type="text/javascript">
2025-04-14 19:07:15 UTC	424	IN	Data Raw: 69 70 74 73 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2d 33 2e 35 2e 30 2e 6a 73 3f 76 3d 33 2e 33 2e 33 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 5f 73 63 72 69 70 74 73 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 66 6f 63 75 73 2d 66 69 72 73 74 2e 63 75 73 74 6f 6d 2e 6a 73 3f 76 3d 33 2e 33 2e 33 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 5f 73 63 72 69 70 74 73 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 62 6c 6f 63 6b 55 49 2d 32 2e 37 30 2e 6a 73 3f 76 3d 33 2e 33 2e 33 32 22 3e 3c 2f 73 63 72 69 70 Data Ascii: ipts/jquery/jquery-migrate-3.5.0.js?v=3.3.32"></script> <script type="text/javascript" src="/_scripts/jquery/jquery.focus-first.custom.js?v=3.3.32"></script> <script type="text/javascript" src="/_scripts/jquery/jquery.blockUI-2.70.js?v=3.3.32"></scrip
2025-04-14 19:07:15 UTC	16384	IN	Data Raw: 35 66 39 65 0d 0a 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 5f 6c 69 62 73 2f 62 6f 6f 74 73 74 72 61 70 5f 33 2e 34 2e 31 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 3d 33 2e 33 2e 33 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 45 6e 61 62 6c 65 50 61 74 63 68 65 73 28 22 73 65 6c 66 2d 63 6c 6f 73 65 64 2d 74 61 67 73 22 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 Data Ascii: 5f9eipt> <script type="text/javascript" src="/_libs/bootstrap_3.4.1/js/bootstrap.min.js?v=3.3.32"></script> <script type="text/javascript">jQuery.migrateEnablePatches("self-closed-tags");</script> <link href="https://fonts.googleapis.com/css?fami
2025-04-14 19:07:15 UTC	8102	IN	Data Raw: 64 69 63 61 6c 20 6f 72 20 64 69 73 61 62 69 6c 69 74 79 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 29 2c 20 61 6e 64 20 6f 74 68 65 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 79 6f 75 2c 20 61 6e 64 20 69 6e 74 65 72 76 69 65 77 69 6e 67 20 70 65 6f 70 6c 65 20 77 68 6f 20 61 72 65 20 6b 6e 6f 77 6c 65 64 67 65 61 62 6c 65 20 61 62 6f 75 74 20 79 6f 75 2e 20 54 68 65 20 72 65 73 75 6c 74 73 20 6f 66 20 74 68 69 73 20 72 65 70 6f 72 74 20 6d 61 79 20 62 65 20 75 73 65 64 20 61 73 20 61 20 66 61 63 74 6f 72 20 69 6e 20 6d 61 6b 69 6e 67 20 65 6d 70 6c 6f 79 6d 65 6e 74 20 64 65 63 69 73 69 6f 6e 73 2e 20 54 68 65 20 73 6f 75 72 63 65 20 6f 66 20 61 6e 79 20 69 6e 76 65 73 74 69 67 61 74 69 76 65 20 63 6f 6e 73 75 6d 65 72 20 72 65 70 6f 72 74 20 Data Ascii: dical or disability information), and other information about you, and interviewing people who are knowledgeable about you. The results of this report may be used as a factor in making employment decisions. The source of any investigative consumer report
2025-04-14 19:07:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	162.247.243.39	443	5416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:07:18 UTC	540	OUT	GET /nr-1044.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 19:07:18 UTC	549	IN	HTTP/1.1 200 OK Connection: close Content-Length: 22890 Last-Modified: Wed, 18 Oct 2023 20:58:59 GMT ETag: "6442aaa45ec28f8b2c541026f3c24871" Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 Content-Type: application/javascript Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Mon, 14 Apr 2025 19:07:18 GMT X-Served-By: cache-pdk-kfty8610032-PDK X-Cache: HIT X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 69 29 7b 69 66 28 21 65 5b 74 5d 29 7b 69 66 28 21 6e 5b 74 5d 29 7b 76 61 72 20 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 5f 5f 6e 72 5f 72 65 71 75 69 72 65 26 26 5f 5f 6e 72 5f 72 65 71 75 69 72 65 3b 69 66 28 21 69 26 26 61 29 72 65 74 75 72 6e 20 61 28 74 2c 21 30 29 3b 69 66 28 6f 29 72 65 74 75 72 6e 20 6f 28 74 2c 21 30 29 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 74 2b 22 27 22 29 7d 76 61 72 20 73 3d 65 5b 74 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6e 5b 74 5d 5b 30 5d 2e 63 61 6c 6c 28 73 2e 65 78 70 6f 72 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 Data Ascii: !function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var a="function"==typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return o(t,!0);throw new Error("Cannot find module '"+t+"'")}var s=e[t]={exports:{}};n[t][0].call(s.exports,function(e){v
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 73 61 63 74 69 6f 6e 3d 28 74 7c 7c 22 68 74 74 70 3a 2f 2f 63 75 73 74 6f 6d 2e 74 72 61 6e 73 61 63 74 69 6f 6e 22 29 2b 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 2c 65 29 7b 76 61 72 20 74 3d 65 3f 65 2d 68 2e 6f 66 66 73 65 74 3a 6e 3b 6c 2e 73 74 6f 72 65 28 22 63 6d 22 2c 22 66 69 6e 69 73 68 65 64 22 2c 7b 6e 61 6d 65 3a 22 66 69 6e 69 73 68 65 64 22 7d 2c 7b 74 69 6d 65 3a 74 7d 29 2c 69 28 6e 2c 7b 6e 61 6d 65 3a 22 66 69 6e 69 73 68 65 64 22 2c 73 74 61 72 74 3a 74 2b 68 2e 6f 66 66 73 65 74 2c 6f 72 69 67 69 6e 3a 22 6e 72 22 7d 29 2c 76 28 22 61 70 69 2d 61 64 64 50 61 67 65 41 63 74 69 6f 6e 22 2c 5b 74 2c 22 66 69 6e 69 73 68 65 64 22 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 6e 2c 65 29 7b 69 66 28 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d Data Ascii: saction=(t\|\|"http://custom.transaction")+e)}function o(n,e){var t=e?e-h.offset:n;l.store("cm","finished",{name:"finished"},{time:t}),i(n,{name:"finished",start:t+h.offset,origin:"nr"}),v("api-addPageAction",[t,"finished"])}function i(n,e){if(e&&"object"==
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 6f 2e 62 61 63 6b 6c 6f 67 5b 6e 5d 2c 74 3d 61 5b 6e 5d 3b 69 66 28 74 29 7b 66 6f 72 28 76 61 72 20 73 3d 30 3b 65 26 26 73 3c 65 2e 6c 65 6e 67 74 68 3b 2b 2b 73 29 72 28 65 5b 73 5d 2c 74 29 3b 69 28 74 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 69 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 5b 30 5d 2e 6f 6e 28 6e 2c 74 5b 31 5d 29 7d 29 7d 29 7d 64 65 6c 65 74 65 20 61 5b 6e 5d 2c 6f 2e 62 61 63 6b 6c 6f 67 5b 6e 5d 3d 6e 75 6c 6c 7d 7d 2c 7b 7d 5d 2c 36 3a 5b 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 6e 29 7b 72 65 74 75 72 6e 20 66 5b 6e 5d 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 6e 7c 7c Data Ascii: ts=function(n){var e=o.backlog[n],t=a[n];if(t){for(var s=0;e&&s<e.length;++s)r(e[s],t);i(t,function(n,e){i(e,function(e,t){t[0].on(n,t[1])})})}delete a[n],o.backlog[n]=null}},{}],6:[function(n,e,t){function r(n){return f[n]}function o(n){return null===n\|\|
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 6d 65 22 2c 22 66 69 72 73 74 62 79 74 65 22 29 2c 6b 2e 6d 65 61 73 75 72 65 28 22 66 65 22 2c 22 66 69 72 73 74 62 79 74 65 22 2c 22 6f 6e 6c 6f 61 64 22 29 2c 6b 2e 6d 65 61 73 75 72 65 28 22 64 63 22 2c 22 66 69 72 73 74 62 79 74 65 22 2c 22 64 6f 6d 43 6f 6e 74 65 6e 74 22 29 3b 76 61 72 20 65 3d 62 2e 67 65 74 28 22 6d 65 61 73 75 72 65 73 22 29 2c 74 3d 68 28 65 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 72 65 74 75 72 6e 22 26 22 2b 6e 2b 22 3d 22 2b 65 2e 70 61 72 61 6d 73 2e 76 61 6c 75 65 7d 29 2e 6a 6f 69 6e 28 22 22 29 3b 69 66 28 74 29 7b 76 61 72 20 72 3d 22 31 22 2c 6f 3d 5b 70 28 6e 29 5d 3b 69 66 28 6f 2e 70 75 73 68 28 74 29 2c 6f 2e 70 75 73 68 28 67 2e 70 61 72 61 6d 28 22 74 74 22 2c 6e 2e 69 6e 66 6f 2e 74 74 47 75 69 64 29 29 2c Data Ascii: me","firstbyte"),k.measure("fe","firstbyte","onload"),k.measure("dc","firstbyte","domContent");var e=b.get("measures"),t=h(e,function(n,e){return"&"+n+"="+e.params.value}).join("");if(t){var r="1",o=[p(n)];if(o.push(t),o.push(g.param("tt",n.info.ttGuid)),
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 73 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 6a 73 65 72 72 6f 72 73 22 3a 61 3d 21 31 2c 69 3d 54 3f 77 2e 62 65 61 63 6f 6e 3a 77 2e 69 6d 67 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 69 66 28 72 2e 6e 65 65 64 52 65 73 70 6f 6e 73 65 29 61 3d 21 30 2c 69 3d 77 2e 78 68 72 3b 65 6c 73 65 20 69 66 28 72 2e 75 6e 6c 6f 61 64 29 61 3d 54 2c 69 3d 54 3f 77 2e 62 65 61 63 6f 6e 3a 77 2e 69 6d 67 3b 65 6c 73 65 20 69 66 28 52 29 61 3d 21 30 2c 69 3d 77 2e 78 68 72 3b 65 6c 73 65 7b 69 66 28 22 65 76 65 6e 74 73 22 21 3d 3d 65 29 72 65 74 75 72 6e 21 31 3b 69 3d 77 2e 69 6d 67 7d 7d 72 65 74 75 72 6e 20 61 26 26 22 65 76 65 6e 74 73 22 3d 3d 3d 65 3f 73 3d 74 2e 62 6f 64 79 2e 65 3a 61 3f 73 3d 79 28 74 2e 62 6f 64 79 29 3a 6f 2b 3d 67 2e 6f 62 6a 28 Data Ascii: s;switch(e){case"jserrors":a=!1,i=T?w.beacon:w.img;break;default:if(r.needResponse)a=!0,i=w.xhr;else if(r.unload)a=T,i=T?w.beacon:w.img;else if(R)a=!0,i=w.xhr;else{if("events"!==e)return!1;i=w.img}}return a&&"events"===e?s=t.body.e:a?s=y(t.body):o+=g.obj(
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 69 76 3e 3c 2f 64 69 76 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 22 3b 76 61 72 20 69 3d 6f 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 64 69 76 22 29 2e 6c 65 6e 67 74 68 3b 34 3d 3d 3d 69 3f 72 2e 69 65 56 65 72 73 69 6f 6e 3d 36 3a 33 3d 3d 3d 69 3f 72 2e 69 65 56 65 72 73 69 6f 6e 3d 37 3a 32 3d 3d 3d 69 3f 72 2e 69 65 56 65 72 73 69 6f 6e 3d 38 3a 31 3d 3d 3d 69 3f 72 2e 69 65 56 65 72 73 69 6f 6e 3d 39 3a 72 2e 69 65 56 65 72 73 69 6f 6e 3d 30 2c 65 2e 65 78 70 6f 72 74 73 3d 72 2e 69 65 56 65 72 73 69 6f 6e 7d 2c 7b 7d 5d 2c 31 30 3a 5b 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 66 75 6e 63 74 69 6f Data Ascii: iv></div><![endif]-->...[if lte IE 9]><div></div><![endif]-->";var i=o.getElementsByTagName("div").length;4===i?r.ieVersion=6:3===i?r.ieVersion=7:2===i?r.ieVersion=8:1===i?r.ieVersion=9:r.ieVersion=0,e.exports=r.ieVersion},{}],10:[function(n,e,t){functio
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 64 6f 6d 43 6f 6d 70 6c 65 74 65 2c 74 2c 65 2c 22 64 63 22 29 2c 69 28 6e 5b 6d 2b 61 5d 2c 74 2c 65 2c 22 6c 22 29 2c 69 28 6e 5b 6d 2b 73 5d 2c 74 2c 65 2c 22 6c 65 22 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 2c 65 29 7b 72 65 74 75 72 6e 20 69 28 6e 2e 74 79 70 65 2c 30 2c 65 2c 22 74 79 22 29 2c 69 28 6e 2e 72 65 64 69 72 65 63 74 43 6f 75 6e 74 2c 30 2c 65 2c 22 72 63 22 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 69 28 6e 2c 65 2c 74 2c 72 29 7b 76 61 72 20 6f 3b 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 26 26 6e 3e 30 26 26 28 6f 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 6e 2d 65 29 2c 74 5b 72 5d 3d 6f 29 2c 76 2e 70 75 73 68 28 6f 29 7d 76 61 72 20 61 3d 22 53 74 61 72 74 22 2c 73 3d 22 45 6e 64 22 2c 75 3d 22 75 6e 6c 6f 61 64 45 76 65 Data Ascii: domComplete,t,e,"dc"),i(n[m+a],t,e,"l"),i(n[m+s],t,e,"le"),e}function o(n,e){return i(n.type,0,e,"ty"),i(n.redirectCount,0,e,"rc"),e}function i(n,e,t,r){var o;"number"==typeof n&&n>0&&(o=Math.round(n-e),t[r]=o),v.push(o)}var a="Start",s="End",u="unloadEve
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 3d 3d 72 2e 63 68 61 72 41 74 28 72 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 72 3d 72 2e 73 75 62 73 74 72 28 30 2c 72 2e 6c 65 6e 67 74 68 2d 31 29 29 29 3a 30 3d 3d 3d 73 5b 75 5d 2e 69 6e 64 65 78 4f 66 28 22 72 3d 22 29 26 26 28 74 3d 73 5b 75 5d 2e 73 75 62 73 74 72 69 6e 67 28 32 29 2c 22 3b 22 3d 3d 3d 74 2e 63 68 61 72 41 74 28 74 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 74 3d 74 2e 73 75 62 73 74 72 28 30 2c 74 2e 6c 65 6e 67 74 68 2d 31 29 29 29 3b 69 66 28 74 29 7b 76 61 72 20 63 3d 61 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 69 3d 63 3d 3d 74 2c 69 7c 7c 28 69 3d 61 28 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3d 3d 74 26 26 63 3d 3d 72 29 7d 69 66 28 69 26 26 6f 29 7b 76 61 72 20 66 3d 28 6e 65 77 20 Data Ascii: ==r.charAt(r.length-1)&&(r=r.substr(0,r.length-1))):0===s[u].indexOf("r=")&&(t=s[u].substring(2),";"===t.charAt(t.length-1)&&(t=t.substr(0,t.length-1)));if(t){var c=a(document.referrer);i=c==t,i\|\|(i=a(document.location.href)==t&&c==r)}if(i&&o){var f=(new
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 74 68 3f 22 7b 7d 22 3a 22 7b 22 2b 72 2e 6a 6f 69 6e 28 22 2c 22 29 2b 22 7d 22 7d 7d 76 61 72 20 61 3d 6e 28 33 30 29 2c 73 3d 6e 28 22 65 65 22 29 2c 75 3d 2f 5b 5c 5c 5c 22 5c 78 30 30 2d 5c 78 31 66 5c 78 37 66 2d 5c 78 39 66 5c 75 30 30 61 64 5c 75 30 36 30 30 2d 5c 75 30 36 30 34 5c 75 30 37 30 66 5c 75 31 37 62 34 5c 75 31 37 62 35 5c 75 32 30 30 63 2d 5c 75 32 30 30 66 5c 75 32 30 32 38 2d 5c 75 32 30 32 66 5c 75 32 30 36 30 2d 5c 75 32 30 36 66 5c 75 66 65 66 66 5c 75 66 66 66 30 2d 5c 75 66 66 66 66 5d 2f 67 2c 63 3d 7b 22 5c 62 22 3a 22 5c 5c 62 22 2c 22 5c 74 22 3a 22 5c 5c 74 22 2c 22 5c 6e 22 3a 22 5c 5c 6e 22 2c 22 5c 66 22 3a 22 5c 5c 66 22 2c 22 5c 72 22 3a 22 5c 5c 72 22 2c 27 22 27 3a 27 5c 5c 22 27 2c 22 5c 5c 22 3a 22 5c 5c 5c 5c 22 Data Ascii: th?"{}":"{"+r.join(",")+"}"}}var a=n(30),s=n("ee"),u=/[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,c={"\b":"\\b","\t":"\\t","\n":"\\n","\f":"\\f","\r":"\\r",'"':'\\"',"\\":"\\\\"
2025-04-14 19:07:18 UTC	1378	IN	Data Raw: 65 6e 67 74 68 3f 7b 6d 6f 64 65 3a 22 73 74 61 63 6b 22 2c 6e 61 6d 65 3a 6e 2e 6e 61 6d 65 7c 7c 63 28 6e 29 2c 6d 65 73 73 61 67 65 3a 6e 2e 6d 65 73 73 61 67 65 2c 73 74 61 63 6b 53 74 72 69 6e 67 3a 6d 28 65 2e 73 74 61 63 6b 4c 69 6e 65 73 29 2c 66 72 61 6d 65 73 3a 65 2e 66 72 61 6d 65 73 7d 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 69 28 6e 2c 65 29 7b 76 61 72 20 74 3d 61 28 65 29 3b 72 65 74 75 72 6e 20 74 3f 28 66 28 74 2e 66 75 6e 63 29 3f 6e 2e 77 72 61 70 70 65 72 53 65 65 6e 3d 21 30 3a 6e 2e 73 74 61 63 6b 4c 69 6e 65 73 2e 70 75 73 68 28 65 29 2c 6e 2e 77 72 61 70 70 65 72 53 65 65 6e 7c 7c 6e 2e 66 72 61 6d 65 73 2e 70 75 73 68 28 74 29 2c 6e 29 3a 28 6e 2e 73 74 61 63 6b 4c 69 6e 65 73 2e 70 75 73 68 28 65 29 2c 6e 29 7d 66 75 6e 63 Data Ascii: ength?{mode:"stack",name:n.name\|\|c(n),message:n.message,stackString:m(e.stackLines),frames:e.frames}:null}function i(n,e){var t=a(e);return t?(f(t.func)?n.wrapperSeen=!0:n.stackLines.push(e),n.wrapperSeen\|\|n.frames.push(t),n):(n.stackLines.push(e),n)}func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	162.247.243.29	443	5416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:07:19 UTC	1020	OUT	GET /1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=1788&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=253&fe=1120&dc=1093&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657636331,%22n%22:0,%22f%22:5,%22dn%22:5,%22dne%22:5,%22c%22:5,%22ce%22:5,%22rq%22:5,%22rp%22:5,%22rpe%22:118,%22dl%22:126,%22di%22:1089,%22ds%22:1092,%22de%22:1093,%22dc%22:1119,%22l%22:1119,%22le%22:1121%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 19:07:19 UTC	521	IN	HTTP/1.1 200 Connection: close Content-Length: 87 date: Mon, 14 Apr 2025 19:07:19 GMT content-type: text/javascript nr-rate-limited: allowed access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * set-cookie: JSESSIONID=68e7260a60b7e390; Path=/; Domain=.nr-data.net; Secure; SameSite=None cross-origin-resource-policy: cross-origin x-served-by: cache-pao-kpao1770050-PAO
2025-04-14 19:07:19 UTC	87	IN	Data Raw: 4e 52 45 55 4d 2e 73 65 74 54 6f 6b 65 6e 28 7b 27 73 74 6e 27 3a 30 2c 27 65 72 72 27 3a 31 2c 27 69 6e 73 27 3a 31 2c 27 73 70 61 27 3a 31 2c 27 73 72 27 3a 30 2c 27 73 72 73 27 3a 30 2c 27 73 74 27 3a 31 2c 27 73 74 73 27 3a 30 2c 27 6c 6f 67 27 3a 30 7d 29 Data Ascii: NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0,'log':0})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49721	162.247.243.29	443	5416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:08:19 UTC	1676	OUT	POST /jserrors/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=61801&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&pve=1&err=%5B%7B%22params%22:%7B%22stackHash%22:334471766,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22showDisclosureOptions%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20showDisclosureOptions%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:27:22%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:2625%7D%7D%7D,%7B%22params%22:%7B%22stackHash%22:334471760,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22jQuery%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20jQuery%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:21:34%22,%22pageview%22:1%7D,% [TRUNCATED] Host: bam.nr-data.net Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=68e7260a60b7e390
2025-04-14 19:08:19 UTC	364	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Mon, 14 Apr 2025 19:08:19 GMT content-type: image/gif nr-rate-limited: allowed access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: null cross-origin-resource-policy: cross-origin x-served-by: cache-pdk-kfty8610034-PDK
2025-04-14 19:08:19 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49731	162.247.243.29	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:08:35 UTC	1045	OUT	GET /1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=283&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=78&fe=264&dc=217&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657713925,%22n%22:0,%22f%22:9,%22dn%22:9,%22dne%22:9,%22c%22:9,%22ce%22:9,%22rq%22:9,%22rp%22:9,%22rpe%22:32,%22dl%22:45,%22di%22:213,%22ds%22:213,%22de%22:217,%22dc%22:263,%22l%22:263,%22le%22:264%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=68e7260a60b7e390
2025-04-14 19:08:35 UTC	521	IN	HTTP/1.1 200 Connection: close Content-Length: 87 date: Mon, 14 Apr 2025 19:08:35 GMT content-type: text/javascript nr-rate-limited: allowed access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * set-cookie: JSESSIONID=68e7260a60b7e390; Path=/; Domain=.nr-data.net; Secure; SameSite=None cross-origin-resource-policy: cross-origin x-served-by: cache-bfi-krnt7300107-BFI
2025-04-14 19:08:35 UTC	87	IN	Data Raw: 4e 52 45 55 4d 2e 73 65 74 54 6f 6b 65 6e 28 7b 27 73 74 6e 27 3a 30 2c 27 65 72 72 27 3a 31 2c 27 69 6e 73 27 3a 31 2c 27 73 70 61 27 3a 31 2c 27 73 72 27 3a 30 2c 27 73 72 73 27 3a 30 2c 27 73 74 27 3a 31 2c 27 73 74 73 27 3a 30 2c 27 6c 6f 67 27 3a 30 7d 29 Data Ascii: NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0,'log':0})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49735	162.247.243.29	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:08:44 UTC	1045	OUT	GET /1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=391&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=167&fe=235&dc=191&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657722960,%22n%22:0,%22f%22:6,%22dn%22:6,%22dne%22:6,%22c%22:6,%22ce%22:6,%22rq%22:6,%22rp%22:6,%22rpe%22:9,%22dl%22:90,%22di%22:191,%22ds%22:191,%22de%22:191,%22dc%22:233,%22l%22:233,%22le%22:236%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=68e7260a60b7e390
2025-04-14 19:08:44 UTC	521	IN	HTTP/1.1 200 Connection: close Content-Length: 87 date: Mon, 14 Apr 2025 19:08:44 GMT content-type: text/javascript nr-rate-limited: allowed access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * set-cookie: JSESSIONID=68e7260a60b7e390; Path=/; Domain=.nr-data.net; Secure; SameSite=None cross-origin-resource-policy: cross-origin x-served-by: cache-bfi-krnt7300060-BFI
2025-04-14 19:08:44 UTC	87	IN	Data Raw: 4e 52 45 55 4d 2e 73 65 74 54 6f 6b 65 6e 28 7b 27 73 74 6e 27 3a 30 2c 27 65 72 72 27 3a 31 2c 27 69 6e 73 27 3a 31 2c 27 73 70 61 27 3a 31 2c 27 73 72 27 3a 30 2c 27 73 72 73 27 3a 30 2c 27 73 74 27 3a 31 2c 27 73 74 73 27 3a 30 2c 27 6c 6f 67 27 3a 30 7d 29 Data Ascii: NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0,'log':0})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49741	162.247.243.29	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:09:35 UTC	1676	OUT	POST /jserrors/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=60286&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&pve=1&err=%5B%7B%22params%22:%7B%22stackHash%22:334471766,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22showDisclosureOptions%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20showDisclosureOptions%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:27:22%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:1188%7D%7D%7D,%7B%22params%22:%7B%22stackHash%22:334471760,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22jQuery%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20jQuery%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:21:34%22,%22pageview%22:1%7D,% [TRUNCATED] Host: bam.nr-data.net Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=68e7260a60b7e390
2025-04-14 19:09:35 UTC	364	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Mon, 14 Apr 2025 19:09:35 GMT content-type: image/gif nr-rate-limited: allowed access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: null cross-origin-resource-policy: cross-origin x-served-by: cache-pdk-kfty8610034-PDK
2025-04-14 19:09:35 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49745	162.247.243.29	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-14 19:09:45 UTC	1676	OUT	POST /jserrors/1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=61312&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&pve=1&err=%5B%7B%22params%22:%7B%22stackHash%22:334471766,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22showDisclosureOptions%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20showDisclosureOptions%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:27:22%22,%22pageview%22:1%7D,%22metrics%22:%7B%22count%22:1,%22time%22:%7B%22t%22:1139%7D%7D%7D,%7B%22params%22:%7B%22stackHash%22:334471760,%22exceptionClass%22:%22ReferenceError%22,%22request_uri%22:%22/C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html%22,%22message%22:%22jQuery%20is%20not%20defined%22,%22stack_trace%22:%22ReferenceError:%20jQuery%20is%20not%20defined%5Cn%20%20%20%20at%20%3Cinline%3E:21:34%22,%22pageview%22:1%7D,% [TRUNCATED] Host: bam.nr-data.net Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=68e7260a60b7e390
2025-04-14 19:09:45 UTC	364	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Mon, 14 Apr 2025 19:09:45 GMT content-type: image/gif nr-rate-limited: allowed access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: null cross-origin-resource-policy: cross-origin x-served-by: cache-pdk-kfty8610023-PDK
2025-04-14 19:09:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	15:07:06
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:07:07
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,12184459624570432134,3079195569910240246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:07:13
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:08:25
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:08:26
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=1936,i,12072537486879388997,15279011085792975354,524288 --field-trial-handle=1756,i,9776161172668221715,2789798183340385106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250414-050123.764000 --mojo-platform-channel-handle=2064 /prefetch:3
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	15:08:33
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Downloads\Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Source: file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: GET /quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5 HTTP/1.1Host: employerschoiceonline.instascreen.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nr-1044.min.js HTTP/1.1Host: js-agent.newrelic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=1788&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=253&fe=1120&dc=1093&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657636331,%22n%22:0,%22f%22:5,%22dn%22:5,%22dne%22:5,%22c%22:5,%22ce%22:5,%22rq%22:5,%22rp%22:5,%22rpe%22:118,%22dl%22:126,%22di%22:1089,%22ds%22:1092,%22de%22:1093,%22dc%22:1119,%22l%22:1119,%22le%22:1121%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken HTTP/1.1Host: bam.nr-data.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=283&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=78&fe=264&dc=217&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657713925,%22n%22:0,%22f%22:9,%22dn%22:9,%22dne%22:9,%22c%22:9,%22ce%22:9,%22rq%22:9,%22rp%22:9,%22rpe%22:32,%22dl%22:45,%22di%22:213,%22ds%22:213,%22de%22:217,%22dc%22:263,%22l%22:263,%22le%22:264%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken HTTP/1.1Host: bam.nr-data.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=68e7260a60b7e390
Source: global traffic	HTTP traffic detected: GET /1/0d2f6deff6?a=4275739&sa=1&v=1044.a6554e7&t=Unnamed%20Transaction&rst=391&ref=file:///C:/Users/user/Downloads/Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html&be=167&fe=235&dc=191&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1744657722960,%22n%22:0,%22f%22:6,%22dn%22:6,%22dne%22:6,%22c%22:6,%22ce%22:6,%22rq%22:6,%22rp%22:6,%22rpe%22:9,%22dl%22:90,%22di%22:191,%22ds%22:191,%22de%22:191,%22dc%22:233,%22l%22:233,%22le%22:236%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken HTTP/1.1Host: bam.nr-data.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=68e7260a60b7e390

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: employerschoiceonline.instascreen.net
Source: global traffic	DNS traffic detected: DNS query: js-agent.newrelic.com
Source: global traffic	DNS traffic detected: DNS query: bam.nr-data.net

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\6482fce5-b414-4e47-aff7-25bcd0ef083a.tmp

C:\Users\user\Downloads\Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html (copy)

C:\Users\user\Downloads\Authorization-Form-BENJAMIN-THOMAS-BRADLEY.html.crdownload

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Static File Info

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6040, Parent PID: 3556

General

File Activities

Windows Analysis Report
https://employerschoiceonline.instascreen.net/quickverify/release.taz?a=6aad0af695a81e45c40904d374f7153bb060e004&e=1744654543000&b=688506155&c=5