hxxps://www[.]key[.]com/mortgage-loan-officer/590019/Michael-DiDonna

Analysis

max time kernel
39s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2023, 14:13 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.key.com/mortgage-loan-officer/590019/Michael-DiDonna

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133338176418841217"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1216	1852	chrome.exe	68
PID 1852 wrote to memory of 1216	1852	chrome.exe	68
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2296	1852	chrome.exe	87
PID 1852 wrote to memory of 2356	1852	chrome.exe	88
PID 1852 wrote to memory of 2356	1852	chrome.exe	88
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89
PID 1852 wrote to memory of 384	1852	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.key.com/mortgage-loan-officer/590019/Michael-DiDonna
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff04479758,0x7fff04479768,0x7fff04479778
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:8
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4588 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1912,i,2619297593739752356,12826627978566472729,131072 /prefetch:8
  2⤵
  PID:5076

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4956

Network

DNS

146.78.124.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.78.124.51.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

241.154.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.154.82.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

www.key.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.key.com

IN A

Response

www.key.com

IN CNAME

www.key.com.edgekey.net

www.key.com.edgekey.net

IN CNAME

e9339.ce.akamaiedge.net

e9339.ce.akamaiedge.net

IN A

92.123.199.112
DNS

112.199.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

112.199.123.92.in-addr.arpa

IN PTR

Response

112.199.123.92.in-addr.arpa

IN PTR

a92-123-199-112deploystaticakamaitechnologiescom
DNS

assets.adobedtm.com

chrome.exe

Remote address:

8.8.8.8:53

Request

assets.adobedtm.com

IN A

Response

assets.adobedtm.com

IN CNAME

cn-assets.adobedtm.com.edgekey.net

cn-assets.adobedtm.com.edgekey.net

IN CNAME

e7808.dscg.akamaiedge.net

e7808.dscg.akamaiedge.net

IN A

23.44.232.235
GET

https://assets.adobedtm.com/5d295d1656df/7359eb90f957/launch-67d04314b146.min.js

chrome.exe

Remote address:

23.44.232.235:443

Request

GET /5d295d1656df/7359eb90f957/launch-67d04314b146.min.js HTTP/2.0
host: assets.adobedtm.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

accept-ranges: bytes
content-type: application/x-javascript
etag: "a03875db6832d4ba652d5e9db18ecd67:1684258935.418882"
last-modified: Tue, 16 May 2023 17:42:15 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 98220
cache-control: max-age=3600
expires: Fri, 14 Jul 2023 15:13:59 GMT
date: Fri, 14 Jul 2023 14:13:59 GMT
access-control-allow-origin: https://www.key.com
timing-allow-origin: *
GET

https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js

chrome.exe

Remote address:

23.44.232.235:443

Request

GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js HTTP/2.0
host: assets.adobedtm.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

accept-ranges: bytes
content-type: application/x-javascript
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 12163
unused62: 8096267
expires: Fri, 14 Jul 2023 15:13:59 GMT
date: Fri, 14 Jul 2023 14:13:59 GMT
cache-control: no-cache
access-control-allow-origin: https://www.key.com
timing-allow-origin: *
GET

https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js

chrome.exe

Remote address:

23.44.232.235:443

Request

GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js HTTP/2.0
host: assets.adobedtm.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

accept-ranges: bytes
content-type: application/x-javascript
etag: "26a8cd142b539700557eb4710c3d56bd:1644856531.982003"
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 8753
unused62: 8096267
expires: Fri, 14 Jul 2023 15:13:59 GMT
date: Fri, 14 Jul 2023 14:13:59 GMT
cache-control: no-cache
access-control-allow-origin: https://www.key.com
timing-allow-origin: *
GET

https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_AudienceManagement.min.js

chrome.exe

Remote address:

23.44.232.235:443

Request

GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_AudienceManagement.min.js HTTP/2.0
host: assets.adobedtm.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

accept-ranges: bytes
content-type: application/x-javascript
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
unused62: 8096267
content-length: 1597
expires: Fri, 14 Jul 2023 15:13:59 GMT
date: Fri, 14 Jul 2023 14:13:59 GMT
cache-control: no-cache
access-control-allow-origin: https://www.key.com
timing-allow-origin: *
DNS

dpm.demdex.net

chrome.exe

Remote address:

8.8.8.8:53

Request

dpm.demdex.net

IN A

Response

dpm.demdex.net

IN CNAME

gslb-2.demdex.net

gslb-2.demdex.net

IN CNAME

edge-irl1.demdex.net

edge-irl1.demdex.net

IN CNAME

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.48.127.113

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.48.195.8

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.208.129.239

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

54.155.194.178

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

18.200.152.171

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

34.249.169.47

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.208.24.37

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.208.156.123
DNS

195.233.44.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.233.44.23.in-addr.arpa

IN PTR

Response

195.233.44.23.in-addr.arpa

IN PTR

a23-44-233-195deploystaticakamaitechnologiescom
DNS

113.127.48.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

113.127.48.52.in-addr.arpa

IN PTR

Response

113.127.48.52.in-addr.arpa

IN PTR

ec2-52-48-127-113 eu-west-1compute amazonawscom
DNS

235.232.44.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

235.232.44.23.in-addr.arpa

IN PTR

Response

235.232.44.23.in-addr.arpa

IN PTR

a23-44-232-235deploystaticakamaitechnologiescom
DNS

keybank.demdex.net

chrome.exe

Remote address:

8.8.8.8:53

Request

keybank.demdex.net

IN A

Response

keybank.demdex.net

IN CNAME

gslb-2.demdex.net

gslb-2.demdex.net

IN CNAME

edge-irl1.demdex.net

edge-irl1.demdex.net

IN CNAME

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

34.243.61.200

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

54.76.136.163

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.208.93.119

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

63.34.168.218

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.49.138.0

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

34.246.32.5

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

52.209.244.112

dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com

IN A

54.217.20.142
DNS

target.key.com

chrome.exe

Remote address:

8.8.8.8:53

Request

target.key.com

IN A

Response

target.key.com

IN CNAME

keybankassociation.tt.omtrdc.net

keybankassociation.tt.omtrdc.net

IN CNAME

adobetarget.data.adobedc.net

adobetarget.data.adobedc.net

IN A

66.235.152.113

adobetarget.data.adobedc.net

IN A

66.235.152.152

adobetarget.data.adobedc.net

IN A

66.235.152.115

adobetarget.data.adobedc.net

IN A

66.235.152.126

adobetarget.data.adobedc.net

IN A

66.235.152.107

adobetarget.data.adobedc.net

IN A

66.235.152.143
DNS

metrics.key.com

chrome.exe

Remote address:

8.8.8.8:53

Request

metrics.key.com

IN A

Response

metrics.key.com

IN CNAME

key.com.data.adobedc.net

key.com.data.adobedc.net

IN A

63.140.62.164

key.com.data.adobedc.net

IN A

63.140.62.135

key.com.data.adobedc.net

IN A

63.140.62.160
DNS

cm.everesttech.net

chrome.exe

Remote address:

8.8.8.8:53

Request

cm.everesttech.net

IN A

Response

cm.everesttech.net

IN CNAME

cm.everesttech.net.akadns.net

cm.everesttech.net.akadns.net

IN A

3.248.138.51

cm.everesttech.net.akadns.net

IN A

34.251.46.32

cm.everesttech.net.akadns.net

IN A

52.50.235.196
GET

https://metrics.key.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&mid=68442406664399466853741778081757377165&ts=1689344038454

chrome.exe

Remote address:

63.140.62.164:443

Request

GET /id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&mid=68442406664399466853741778081757377165&ts=1689344038454 HTTP/2.0
host: metrics.key.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded
accept: */*
origin: https://www.key.com
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: at_check=true
cookie: mbox=session#a8b777ac93ce432eb5dbba7c3d98ed88#1689345899
cookie: AMCVS_295C0C0F53DB0ED00A490D45%40AdobeOrg=1
cookie: AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=1176715910%7CMCIDTS%7C19553%7CMCMID%7C68442406664399466853741778081757377165%7CMCAAMLH-1689948838%7C6%7CMCAAMB-1689948838%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1689351238s%7CNONE%7CvVersion%7C5.4.0

Response

HTTP/2.0 200

access-control-allow-origin: https://www.key.com
access-control-allow-credentials: true
date: Fri, 14 Jul 2023 14:14:00 GMT
p3p: CP="This is not a P3P policy"
server: jag
set-cookie: s_ecid=MCMID%7C68442406664399466853741778081757377165; Path=/; Domain=key.com; Max-Age=63072000; Expires=Sun, 13 Jul 2025 14:14:14 GMT; SameSite=Lax;
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 48
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
GET

https://metrics.key.com/b/ss/keybankglobalprod/10/JS-2.22.4-LDQM/s05597520550058?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=14%2F6%2F2023%2014%3A13%3A59%205%200&d.&nsid=0&jsonv=1&.d&sdid=70085B506832C306-413B57FBFDC0C408&mid=68442406664399466853741778081757377165&aamlh=6&ce=UTF-8&ns=keybank&pageName=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&g=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c.&getValOnce=3.0&getAndPersistValue=3.0&getPreviousValue=3.0&getPercentPageViewed=5.0.1&handlePPVevents=4.0&p_fo=3.0&apl=4.0&inList=3.0&getQueryParam=4.0.1&pt=3.0&.c&cc=USD&ch=personal&server=www.key.com&events=event33&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c10=home%20loans%20lines&v10=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&c11=mortgage&c26=%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c29=D%3Dmid&v37=N&v74=key.com&v119=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&s=1280x720&c=24&j=1.6&v=N&k=Y&bw=1280&bh=609&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&AQE=1

chrome.exe

Remote address:

63.140.62.164:443

Request

GET /b/ss/keybankglobalprod/10/JS-2.22.4-LDQM/s05597520550058?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=14%2F6%2F2023%2014%3A13%3A59%205%200&d.&nsid=0&jsonv=1&.d&sdid=70085B506832C306-413B57FBFDC0C408&mid=68442406664399466853741778081757377165&aamlh=6&ce=UTF-8&ns=keybank&pageName=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&g=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c.&getValOnce=3.0&getAndPersistValue=3.0&getPreviousValue=3.0&getPercentPageViewed=5.0.1&handlePPVevents=4.0&p_fo=3.0&apl=4.0&inList=3.0&getQueryParam=4.0.1&pt=3.0&.c&cc=USD&ch=personal&server=www.key.com&events=event33&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c10=home%20loans%20lines&v10=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&c11=mortgage&c26=%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c29=D%3Dmid&v37=N&v74=key.com&v119=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&s=1280x720&c=24&j=1.6&v=N&k=Y&bw=1280&bh=609&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&AQE=1 HTTP/2.0
host: metrics.key.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: at_check=true
cookie: AMCVS_295C0C0F53DB0ED00A490D45%40AdobeOrg=1
cookie: s_ecid=MCMID%7C68442406664399466853741778081757377165
cookie: AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=1176715910%7CMCIDTS%7C19553%7CMCMID%7C68442406664399466853741778081757377165%7CMCAAMLH-1689948838%7C6%7CMCAAMB-1689948838%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1689351238s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0
cookie: mbox=session#a8b777ac93ce432eb5dbba7c3d98ed88#1689345900|PC#a8b777ac93ce432eb5dbba7c3d98ed88.37_0#1752588840
cookie: gpv_Page=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer
cookie: s_ips=609
cookie: s_tp=2530
cookie: s_ppv=key.com%253Apersonal%253Ahome%2520loans%2520lines%253Amortgage%253Amortgage%2520loan%2520officer%2C24%2C24%2C609%2C1%2C4
cookie: s_cc=true

Response

HTTP/2.0 200

access-control-allow-origin: *
date: Fri, 14 Jul 2023 14:14:01 GMT
expires: Thu, 13 Jul 2023 14:14:01 GMT
last-modified: Sat, 15 Jul 2023 14:14:01 GMT
pragma: no-cache
p3p: CP="This is not a P3P policy"
server: jag
set-cookie: s_ecid=MCMID%7C68442406664399466853741778081757377165; Path=/; Domain=key.com; Max-Age=63072000; Expires=Sun, 13 Jul 2025 14:14:14 GMT;
etag: 3627838704714940416-4619724515754263139
vary: *
dcs: dcs-prod-irl1-1-v050-08be7f100.edge-irl1.demdex.com 6 ms
x-aam-tid: X2aLy4ZbSVE=
content-type: application/x-javascript;charset=utf-8
content-length: 2262
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
POST

https://target.key.com/rest/v1/delivery?client=keybankassociation&sessionId=a8b777ac93ce432eb5dbba7c3d98ed88&version=2.9.0

chrome.exe

Remote address:

66.235.152.113:443

Request

POST /rest/v1/delivery?client=keybankassociation&sessionId=a8b777ac93ce432eb5dbba7c3d98ed88&version=2.9.0 HTTP/2.0
host: target.key.com
content-length: 1240
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: text/plain
accept: */*
origin: https://www.key.com
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: at_check=true
cookie: mbox=session#a8b777ac93ce432eb5dbba7c3d98ed88#1689345899
cookie: AMCVS_295C0C0F53DB0ED00A490D45%40AdobeOrg=1
cookie: AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=1176715910%7CMCIDTS%7C19553%7CMCMID%7C68442406664399466853741778081757377165%7CMCAAMLH-1689948838%7C6%7CMCAAMB-1689948838%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1689351238s%7CNONE%7CvVersion%7C5.4.0

Response

HTTP/2.0 200

date: Fri, 14 Jul 2023 14:14:00 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
access-control-allow-origin: https://www.key.com
access-control-allow-credentials: true
x-request-id: 18b18921-ed2f-4170-9b25-5152227527c4
timing-allow-origin: *
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
server: jag
DNS

www.everestjs.net

chrome.exe

Remote address:

8.8.8.8:53

Request

www.everestjs.net

IN A

Response

www.everestjs.net

IN CNAME

www.everestjs.net.edgekey.net

www.everestjs.net.edgekey.net

IN CNAME

e9518.c.akamaiedge.net

e9518.c.akamaiedge.net

IN A

23.39.242.212
GET

https://www.everestjs.net/static/le/last-event-tag-latest.min.js

chrome.exe

Remote address:

23.39.242.212:443

Request

GET /static/le/last-event-tag-latest.min.js HTTP/1.1
Host: www.everestjs.net
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: */*
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: script
Referer: https://www.key.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

x-amz-id-2: cAZLcaOOw7SlbVHy7PJ6zPVHDzAhIvkJddmvGnvPfWIeHqwXoEVsttpWgkKEQbKcg7QMwUt7PA0=
x-amz-request-id: C9DRZ9HQ2DSSJNG1
Last-Modified: Wed, 16 Jun 2021 15:18:41 GMT
ETag: "d5991c18a0042eb33f92c6b5b44ffe8d"
x-amz-version-id: null
Accept-Ranges: bytes
Content-Type: application/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 14 Jul 2023 14:14:01 GMT
Content-Length: 2663
Connection: keep-alive
DNS

200.61.243.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.61.243.34.in-addr.arpa

IN PTR

Response

200.61.243.34.in-addr.arpa

IN PTR

ec2-34-243-61-200 eu-west-1compute amazonawscom
DNS

51.138.248.3.in-addr.arpa

Remote address:

8.8.8.8:53

Request

51.138.248.3.in-addr.arpa

IN PTR

Response

51.138.248.3.in-addr.arpa

IN PTR

ec2-3-248-138-51 eu-west-1compute amazonawscom
DNS

164.62.140.63.in-addr.arpa

Remote address:

8.8.8.8:53

Request

164.62.140.63.in-addr.arpa

IN PTR

Response

164.62.140.63.in-addr.arpa

IN PTR

ip-63-140-62-164dataadobedcnet
DNS

113.152.235.66.in-addr.arpa

Remote address:

8.8.8.8:53

Request

113.152.235.66.in-addr.arpa

IN PTR

Response

113.152.235.66.in-addr.arpa

IN PTR

ip-66-235-152-113dataadobedcnet
DNS

212.242.39.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

212.242.39.23.in-addr.arpa

IN PTR

Response

212.242.39.23.in-addr.arpa

IN PTR

a23-39-242-212deploystaticakamaitechnologiescom
DNS

sync-tm.everesttech.net

chrome.exe

Remote address:

8.8.8.8:53

Request

sync-tm.everesttech.net

IN A

Response

sync-tm.everesttech.net

IN CNAME

sync.tubemogul.com

sync.tubemogul.com

IN CNAME

syncf.tubemogul.com

syncf.tubemogul.com

IN CNAME

h2.shared.global.fastly.net

h2.shared.global.fastly.net

IN A

151.101.2.49

h2.shared.global.fastly.net

IN A

151.101.66.49

h2.shared.global.fastly.net

IN A

151.101.130.49

h2.shared.global.fastly.net

IN A

151.101.194.49
DNS

bat.bing.com

chrome.exe

Remote address:

8.8.8.8:53

Request

bat.bing.com

IN A

Response

bat.bing.com

IN CNAME

bat-bing-com.a-0001.a-msedge.net

bat-bing-com.a-0001.a-msedge.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
DNS

lasteventf-tm.everesttech.net

chrome.exe

Remote address:

8.8.8.8:53

Request

lasteventf-tm.everesttech.net

IN A

Response

lasteventf-tm.everesttech.net

IN CNAME

lasteventf.tubemogul.com

lasteventf.tubemogul.com

IN CNAME

h2.shared.global.fastly.net

h2.shared.global.fastly.net

IN A

151.101.2.49

h2.shared.global.fastly.net

IN A

151.101.66.49

h2.shared.global.fastly.net

IN A

151.101.130.49

h2.shared.global.fastly.net

IN A

151.101.194.49
DNS

googleads.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A

Response

googleads.g.doubleclick.net

IN A

172.217.23.194
GET

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1052626284/?random=1689344040074&cv=11&fst=1689344040074&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1280&u_h=720&url=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&hn=www.googleadservices.com&frm=0&tiba=Mortgage%20Loan%20Officer%20%7C%20Michael%20DiDonna&auid=2047923229.1689344040&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

chrome.exe

Remote address:

172.217.23.194:443

Request

GET /pagead/viewthroughconversion/1052626284/?random=1689344040074&cv=11&fst=1689344040074&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1280&u_h=720&url=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&hn=www.googleadservices.com&frm=0&tiba=Mortgage%20Loan%20Officer%20%7C%20Michael%20DiDonna&auid=2047923229.1689344040&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/2.0
host: googleads.g.doubleclick.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.key.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

49.2.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

49.2.101.151.in-addr.arpa

IN PTR

Response
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

8.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.36.251.142.in-addr.arpa

IN PTR

Response

8.36.251.142.in-addr.arpa

IN PTR

ams15s44-in-f81e100net
DNS

dsum-sec.casalemedia.com

chrome.exe

Remote address:

8.8.8.8:53

Request

dsum-sec.casalemedia.com

IN A

Response

dsum-sec.casalemedia.com

IN CNAME

um.indexww.com.akadns.net

um.indexww.com.akadns.net

IN CNAME

u12.lb.indexww.com

u12.lb.indexww.com

IN CNAME

fr-xn.lb.indexww.com

fr-xn.lb.indexww.com

IN A

185.80.39.216
DNS

sync.search.spotxchange.com

chrome.exe

Remote address:

8.8.8.8:53

Request

sync.search.spotxchange.com

IN A

Response

sync.search.spotxchange.com

IN CNAME

sync.search-gtm.spotxchange.com.akadns.net

sync.search-gtm.spotxchange.com.akadns.net

IN CNAME

ams01.sync.search.spotxchange.com

ams01.sync.search.spotxchange.com

IN A

185.94.180.126

ams01.sync.search.spotxchange.com

IN A

185.94.180.125
GET

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN

chrome.exe

Remote address:

185.80.39.216:443

Request

GET /rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN HTTP/1.1
Host: dsum-sec.casalemedia.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://keybank.demdex.net/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 302 Found

Date: Fri, 14 Jul 2023 14:14:02 GMT
Server: Apache
Cache-Control: no-cache
Expires: 0
Location: /rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Content-Length: 0
Set-Cookie: CMID=ZLFYKpzDtdFyhKn6PocSigAA; Path=/; Domain=casalemedia.com; Expires=Sat, 13 Jul 2024 14:14:02 GMT; Max-Age=31536000; Secure; SameSite=None
Set-Cookie: CMPS=5203; Path=/; Domain=casalemedia.com; Expires=Thu, 12 Oct 2023 14:14:02 GMT; Max-Age=7776000; Secure; SameSite=None
Set-Cookie: CMPRO=5203; Path=/; Domain=casalemedia.com; Expires=Thu, 12 Oct 2023 14:14:02 GMT; Max-Age=7776000; Secure; SameSite=None
Keep-Alive: timeout=1, max=500
Connection: Keep-Alive
GET

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN&C=1

chrome.exe

Remote address:

185.80.39.216:443

Request

GET /rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN&C=1 HTTP/1.1
Host: dsum-sec.casalemedia.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://keybank.demdex.net/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: CMID=ZLFYKpzDtdFyhKn6PocSigAA; CMPS=5203; CMPRO=5203

Response

HTTP/1.1 200 OK

Date: Fri, 14 Jul 2023 14:14:02 GMT
Server: Apache
Cache-Control: no-cache
Content-Type: image/gif
Expires: 0
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Content-Length: 43
Set-Cookie: CMID=ZLFYKpzDtdFyhKn6PocSigAA; Path=/; Domain=casalemedia.com; Expires=Sat, 13 Jul 2024 14:14:02 GMT; Max-Age=31536000; Secure; SameSite=None
Set-Cookie: CMPS=5203; Path=/; Domain=casalemedia.com; Expires=Thu, 12 Oct 2023 14:14:02 GMT; Max-Age=7776000; Secure; SameSite=None
Set-Cookie: CMPRO=5203; Path=/; Domain=casalemedia.com; Expires=Thu, 12 Oct 2023 14:14:02 GMT; Max-Age=7776000; Secure; SameSite=None
Keep-Alive: timeout=1, max=499
Connection: Keep-Alive
DNS

www.facebook.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.facebook.com

IN A

Response

www.facebook.com

IN CNAME

star-mini.c10r.facebook.com

star-mini.c10r.facebook.com

IN A

157.240.201.35
DNS

194.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

194.23.217.172.in-addr.arpa

IN PTR

Response

194.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f21e100net

194.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f2�H

194.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f194�H
DNS

226.21.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.21.18.104.in-addr.arpa

IN PTR

Response
DNS

112.211.227.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

112.211.227.13.in-addr.arpa

IN PTR

Response

112.211.227.13.in-addr.arpa

IN PTR

server-13-227-211-112ams54r cloudfrontnet
DNS

196.168.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.168.217.172.in-addr.arpa

IN PTR

Response

196.168.217.172.in-addr.arpa

IN PTR

ams16s32-in-f41e100net
DNS

216.39.80.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

216.39.80.185.in-addr.arpa

IN PTR

Response
DNS

126.180.94.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

126.180.94.185.in-addr.arpa

IN PTR

Response
DNS

35.201.240.157.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.201.240.157.in-addr.arpa

IN PTR

Response

35.201.240.157.in-addr.arpa

IN PTR

edge-star-mini-shv-01-ams4facebookcom
DNS

59.128.231.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

59.128.231.4.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

8.3.197.209.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.3.197.209.in-addr.arpa

IN PTR

Response

8.3.197.209.in-addr.arpa

IN PTR

vip0x008map2sslhwcdnnet
DNS

assets.msn.com

Remote address:

8.8.8.8:53

Request

assets.msn.com

IN A

Response

assets.msn.com

IN CNAME

assets.msn.com.edgekey.net

assets.msn.com.edgekey.net

IN CNAME

e28578.d.akamaiedge.net

e28578.d.akamaiedge.net

IN A

2.16.241.97

e28578.d.akamaiedge.net

IN A

2.16.241.76
GET

https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=60bb5805-443b-4a08-92e3-e2ad20f8cb60&ocid=windows-windowsShell-feeds&user=m-42f56b9cd06847c1812b0f140b42a75c&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask

Remote address:

2.16.241.97:443

Request

GET /serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=60bb5805-443b-4a08-92e3-e2ad20f8cb60&ocid=windows-windowsShell-feeds&user=m-42f56b9cd06847c1812b0f140b42a75c&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask HTTP/2.0
host: assets.msn.com
x-search-account: None
accept-encoding: gzip, deflate
x-device-machineid: {08EB9879-81A5-4E4E-A80F-4163F1CC8D81}
x-userageclass: Unknown
x-bm-market: US
x-bm-dateformat: M/d/yyyy
x-device-ossku: 48
x-bm-dtz: 0
x-deviceid: 0100B2E609000CC3
x-bm-windowsflights: FX:119E26AD,FX:11D898D7,FX:11DB147C,FX:11DE505A,FX:11E11E97,FX:11E3E2BA,FX:11E50151,FX:11E9EE98,FX:11F1992A,FX:11F4161E,FX:11F41B68,FX:11FB0F2F,FX:1201B330,FX:1202B7FC,FX:120BB68E,FX:121A20E1,FX:121BF15F,FX:121E5EC8,FX:122D8E86,FX:123031A3,FX:1231B88B,FX:123371B1,FX:1233C945,FX:123D7C31,FX:1240013C,FX:1246E4A3,FX:1248306D,FX:124B38D0,FX:1250080B,FX:125A7FDA,FX:1264FA75,FX:126DBC22,FX:127159BE,FX:12769734,FX:127C935B,FX:127DC03A,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5
sitename: www.msn.com
x-bm-theme: 000000;0078d7
muid: 42F56B9CD06847C1812B0F140B42A75C
x-agent-deviceid: 0100B2E609000CC3
x-bm-onlinesearchdisabled: true
x-bm-cbt: 1688392581
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19041.1288) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
x-device-isoptin: false
accept-language: en-US, en
x-device-touch: false
x-device-clientsession: 075A07AF7328438298B4E263AFDDF0E5
cookie: MUID=42F56B9CD06847C1812B0F140B42A75C

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
server: Kestrel
access-control-allow-credentials: true
access-control-allow-headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent
access-control-allow-methods: PUT,PATCH,POST,GET,OPTIONS,DELETE
access-control-allow-origin: *.msn.com
access-control-expose-headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent
content-encoding: gzip
ddd-authenticatedwithjwtflow: False
ddd-usertype: AnonymousMuid
ddd-tmpl: lowT:0;winbadge:1;daucoldcap:1;partialResponse:1;tbn:0;coldStart:1;lowC:0;coldStartUpsell:1
ddd-feednewsitemcount: 0
x-wpo-activityid: C09A79E3-F846-4B13-A76F-2A6CF8319E6F|2023-07-14T14:14:31.8721108Z|fabric:/wpo|FRC|WPO_85
ddd-activityid: c09a79e3-f846-4b13-a76f-2a6cf8319e6f
ddd-strategyexecutionlatency: 00:00:00.2134745
ddd-debugid: c09a79e3-f846-4b13-a76f-2a6cf8319e6f|2023-07-14T14:14:31.8835244Z|fabric:/winfeed|FRC|WinFeed_419
onewebservicelatency: 214
x-msedge-responseinfo: 214
x-ceto-ref: 64b15847d46c4db497e26f3fc4e2e765|2023-07-14T14:14:31.666Z
expires: Fri, 14 Jul 2023 14:14:31 GMT
date: Fri, 14 Jul 2023 14:14:31 GMT
content-length: 9456
akamai-request-bc: [a=2.16.240.33,b=312660998,c=g,n=DE_HE_FRANKFURT,o=20940],[a=20.74.25.147,c=o]
server-timing: clientrtt; dur=9, clienttt; dur=229, origin; dur=227 , cdntime; dur=2
akamai-cache-status: Miss from child
akamai-server-ip: 2.16.240.33
akamai-request-id: 12a2d406
x-as-suppresssetcookie: 1
cache-control: private, max-age=0
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
vary: Origin
DNS

97.241.16.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.241.16.2.in-addr.arpa

IN PTR

Response

97.241.16.2.in-addr.arpa

IN PTR

a2-16-241-97deploystaticakamaitechnologiescom

92.123.199.112:443

www.key.com

tls

chrome.exe

23.6kB
960.3kB
399
747
23.44.232.235:443

https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_AudienceManagement.min.js

tls, http2

chrome.exe

4.2kB
132.4kB
61
110

HTTP Request

GET https://assets.adobedtm.com/5d295d1656df/7359eb90f957/launch-67d04314b146.min.js

HTTP Response

200

HTTP Request

GET https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js

HTTP Response

200

HTTP Request

GET https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js

HTTP Request

GET https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_AudienceManagement.min.js

HTTP Response

200

HTTP Response

200
52.48.127.113:443

dpm.demdex.net

tls

chrome.exe

3.6kB
8.6kB
12
11
34.243.61.200:443

keybank.demdex.net

tls

chrome.exe

1.8kB
8.4kB
9
10
3.248.138.51:443

cm.everesttech.net

tls

chrome.exe

1.8kB
6.7kB
11
13
63.140.62.164:443

https://metrics.key.com/b/ss/keybankglobalprod/10/JS-2.22.4-LDQM/s05597520550058?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=14%2F6%2F2023%2014%3A13%3A59%205%200&d.&nsid=0&jsonv=1&.d&sdid=70085B506832C306-413B57FBFDC0C408&mid=68442406664399466853741778081757377165&aamlh=6&ce=UTF-8&ns=keybank&pageName=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&g=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c.&getValOnce=3.0&getAndPersistValue=3.0&getPreviousValue=3.0&getPercentPageViewed=5.0.1&handlePPVevents=4.0&p_fo=3.0&apl=4.0&inList=3.0&getQueryParam=4.0.1&pt=3.0&.c&cc=USD&ch=personal&server=www.key.com&events=event33&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c10=home%20loans%20lines&v10=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&c11=mortgage&c26=%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c29=D%3Dmid&v37=N&v74=key.com&v119=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&s=1280x720&c=24&j=1.6&v=N&k=Y&bw=1280&bh=609&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&AQE=1

tls, http2

chrome.exe

3.7kB
7.9kB
18
18

HTTP Request

GET https://metrics.key.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&mid=68442406664399466853741778081757377165&ts=1689344038454

HTTP Response

200

HTTP Request

GET https://metrics.key.com/b/ss/keybankglobalprod/10/JS-2.22.4-LDQM/s05597520550058?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=14%2F6%2F2023%2014%3A13%3A59%205%200&d.&nsid=0&jsonv=1&.d&sdid=70085B506832C306-413B57FBFDC0C408&mid=68442406664399466853741778081757377165&aamlh=6&ce=UTF-8&ns=keybank&pageName=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&g=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c.&getValOnce=3.0&getAndPersistValue=3.0&getPreviousValue=3.0&getPercentPageViewed=5.0.1&handlePPVevents=4.0&p_fo=3.0&apl=4.0&inList=3.0&getQueryParam=4.0.1&pt=3.0&.c&cc=USD&ch=personal&server=www.key.com&events=event33&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c10=home%20loans%20lines&v10=key.com%3Apersonal%3Ahome%20loans%20lines%3Amortgage%3Amortgage%20loan%20officer&c11=mortgage&c26=%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&c29=D%3Dmid&v37=N&v74=key.com&v119=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&s=1280x720&c=24&j=1.6&v=N&k=Y&bw=1280&bh=609&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&AQE=1

HTTP Response

200
66.235.152.113:443

https://target.key.com/rest/v1/delivery?client=keybankassociation&sessionId=a8b777ac93ce432eb5dbba7c3d98ed88&version=2.9.0

tls, http2

chrome.exe

3.4kB
5.6kB
16
16

HTTP Request

POST https://target.key.com/rest/v1/delivery?client=keybankassociation&sessionId=a8b777ac93ce432eb5dbba7c3d98ed88&version=2.9.0

HTTP Response

200
23.39.242.212:443

https://www.everestjs.net/static/le/last-event-tag-latest.min.js

tls, http

chrome.exe

1.6kB
7.8kB
10
12

HTTP Request

GET https://www.everestjs.net/static/le/last-event-tag-latest.min.js

HTTP Response

200
151.101.2.49:443

sync-tm.everesttech.net

tls

chrome.exe

1.1kB
5.5kB
11
11
151.101.2.49:443

sync-tm.everesttech.net

tls

chrome.exe

1.0kB
5.3kB
9
9
151.101.2.49:443

sync-tm.everesttech.net

tls

chrome.exe

1.0kB
5.4kB
9
10
151.101.2.49:443

sync-tm.everesttech.net

tls

chrome.exe

4.8kB
11.9kB
29
38
151.101.2.49:443

sync-tm.everesttech.net

tls

chrome.exe

1.1kB
5.5kB
11
11
151.101.2.49:443

sync-tm.everesttech.net

tls

chrome.exe

1.1kB
5.5kB
11
11
204.79.197.200:443

bat.bing.com

tls

chrome.exe

2.5kB
21.9kB
20
30
151.101.2.49:443

lasteventf-tm.everesttech.net

tls

chrome.exe

1.8kB
5.8kB
10
13
172.217.23.194:443

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1052626284/?random=1689344040074&cv=11&fst=1689344040074&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1280&u_h=720&url=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&hn=www.googleadservices.com&frm=0&tiba=Mortgage%20Loan%20Officer%20%7C%20Michael%20DiDonna&auid=2047923229.1689344040&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

tls, http2

chrome.exe

2.1kB
8.3kB
13
15

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1052626284/?random=1689344040074&cv=11&fst=1689344040074&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1280&u_h=720&url=https%3A%2F%2Fwww.key.com%2Fmortgage-loan-officer%2F590019%2FMichael-DiDonna&hn=www.googleadservices.com&frm=0&tiba=Mortgage%20Loan%20Officer%20%7C%20Michael%20DiDonna&auid=2047923229.1689344040&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
185.80.39.216:443

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN&C=1

tls, http

chrome.exe

2.7kB
8.6kB
16
15

HTTP Request

GET https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN

HTTP Response

302

HTTP Request

GET https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZLFYKQAAASEmNgAN&_test=ZLFYKQAAASEmNgAN&C=1

HTTP Response

200
185.94.180.126:443

sync.search.spotxchange.com

tls

chrome.exe

2.5kB
5.0kB
9
11
157.240.201.35:443

www.facebook.com

tls

chrome.exe

1.6kB
4.7kB
10
11
2.16.241.97:443

https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=60bb5805-443b-4a08-92e3-e2ad20f8cb60&ocid=windows-windowsShell-feeds&user=m-42f56b9cd06847c1812b0f140b42a75c&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask

tls, http2

2.8kB
18.7kB
25
24

HTTP Request

GET https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=60bb5805-443b-4a08-92e3-e2ad20f8cb60&ocid=windows-windowsShell-feeds&user=m-42f56b9cd06847c1812b0f140b42a75c&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask

HTTP Response

200

8.8.8.8:53

146.78.124.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

146.78.124.51.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

241.154.82.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.154.82.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

www.key.com

dns

chrome.exe

57 B
144 B
1
1

DNS Request

www.key.com

DNS Response

92.123.199.112
8.8.8.8:53

112.199.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

112.199.123.92.in-addr.arpa
8.8.8.8:53

assets.adobedtm.com

dns

chrome.exe

65 B
165 B
1
1

DNS Request

assets.adobedtm.com

DNS Response

23.44.232.235
8.8.8.8:53

dpm.demdex.net

dns

chrome.exe

60 B
298 B
1
1

DNS Request

dpm.demdex.net

DNS Response

52.48.127.113

52.48.195.8

52.208.129.239

54.155.194.178

18.200.152.171

34.249.169.47

52.208.24.37

52.208.156.123
8.8.8.8:53

195.233.44.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

195.233.44.23.in-addr.arpa
8.8.8.8:53

113.127.48.52.in-addr.arpa

dns

72 B
135 B
1
1

DNS Request

113.127.48.52.in-addr.arpa
8.8.8.8:53

235.232.44.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

235.232.44.23.in-addr.arpa
8.8.8.8:53

keybank.demdex.net

dns

chrome.exe

64 B
302 B
1
1

DNS Request

keybank.demdex.net

DNS Response

34.243.61.200

54.76.136.163

52.208.93.119

63.34.168.218

52.49.138.0

34.246.32.5

52.209.244.112

54.217.20.142
8.8.8.8:53

target.key.com

dns

chrome.exe

60 B
241 B
1
1

DNS Request

target.key.com

DNS Response

66.235.152.113

66.235.152.152

66.235.152.115

66.235.152.126

66.235.152.107

66.235.152.143
8.8.8.8:53

metrics.key.com

dns

chrome.exe

61 B
147 B
1
1

DNS Request

metrics.key.com

DNS Response

63.140.62.164

63.140.62.135

63.140.62.160
8.8.8.8:53

cm.everesttech.net

dns

chrome.exe

64 B
152 B
1
1

DNS Request

cm.everesttech.net

DNS Response

3.248.138.51

34.251.46.32

52.50.235.196
8.8.8.8:53

www.everestjs.net

dns

chrome.exe

63 B
152 B
1
1

DNS Request

www.everestjs.net

DNS Response

23.39.242.212
8.8.8.8:53

200.61.243.34.in-addr.arpa

dns

72 B
135 B
1
1

DNS Request

200.61.243.34.in-addr.arpa
8.8.8.8:53

51.138.248.3.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

51.138.248.3.in-addr.arpa
8.8.8.8:53

164.62.140.63.in-addr.arpa

dns

72 B
119 B
1
1

DNS Request

164.62.140.63.in-addr.arpa
8.8.8.8:53

113.152.235.66.in-addr.arpa

dns

73 B
121 B
1
1

DNS Request

113.152.235.66.in-addr.arpa
8.8.8.8:53

212.242.39.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

212.242.39.23.in-addr.arpa
8.8.8.8:53

sync-tm.everesttech.net

dns

chrome.exe

69 B
223 B
1
1

DNS Request

sync-tm.everesttech.net

DNS Response

151.101.2.49

151.101.66.49

151.101.130.49

151.101.194.49
8.8.8.8:53

bat.bing.com

dns

chrome.exe

58 B
162 B
1
1

DNS Request

bat.bing.com

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

lasteventf-tm.everesttech.net

dns

chrome.exe

75 B
215 B
1
1

DNS Request

lasteventf-tm.everesttech.net

DNS Response

151.101.2.49

151.101.66.49

151.101.130.49

151.101.194.49
8.8.8.8:53

googleads.g.doubleclick.net

dns

chrome.exe

73 B
89 B
1
1

DNS Request

googleads.g.doubleclick.net

DNS Response

172.217.23.194
8.8.8.8:53

49.2.101.151.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

49.2.101.151.in-addr.arpa
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa
8.8.8.8:53

8.36.251.142.in-addr.arpa

dns

71 B
109 B
1
1

DNS Request

8.36.251.142.in-addr.arpa
8.8.8.8:53

dsum-sec.casalemedia.com

dns

chrome.exe

70 B
174 B
1
1

DNS Request

dsum-sec.casalemedia.com

DNS Response

185.80.39.216
8.8.8.8:53

sync.search.spotxchange.com

dns

chrome.exe

73 B
181 B
1
1

DNS Request

sync.search.spotxchange.com

DNS Response

185.94.180.126

185.94.180.125
8.8.8.8:53

www.facebook.com

dns

chrome.exe

62 B
107 B
1
1

DNS Request

www.facebook.com

DNS Response

157.240.201.35
8.8.8.8:53

194.23.217.172.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

194.23.217.172.in-addr.arpa
8.8.8.8:53

226.21.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

226.21.18.104.in-addr.arpa
8.8.8.8:53

112.211.227.13.in-addr.arpa

dns

73 B
131 B
1
1

DNS Request

112.211.227.13.in-addr.arpa
8.8.8.8:53

196.168.217.172.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

196.168.217.172.in-addr.arpa
8.8.8.8:53

216.39.80.185.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

216.39.80.185.in-addr.arpa
8.8.8.8:53

126.180.94.185.in-addr.arpa

dns

73 B
133 B
1
1

DNS Request

126.180.94.185.in-addr.arpa
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

35.201.240.157.in-addr.arpa

dns

73 B
126 B
1
1

DNS Request

35.201.240.157.in-addr.arpa
8.8.8.8:53

59.128.231.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

59.128.231.4.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

8.3.197.209.in-addr.arpa

dns

70 B
111 B
1
1

DNS Request

8.3.197.209.in-addr.arpa
8.8.8.8:53

assets.msn.com

dns

60 B
166 B
1
1

DNS Request

assets.msn.com

DNS Response

2.16.241.97

2.16.241.76
8.8.8.8:53

97.241.16.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

97.241.16.2.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
290B

MD5
1d0a52b7c01db15a0fdec7ae07558c01

SHA1
52ace199997d0b697476994ed8e0d54236a99902

SHA256
29ea51a34be548772bf4894eb800ee557e2a536d87cbb5dc467d8434bc567eb7

SHA512
2f18fa4cb80be14b10874d7c1b576ad505745f73235e590999cf1498ffad0918a3594546008b1ee41fadcbda86c6b22c6f80a3ab5d985de72ccb6bd71af7c3d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
b7e6117a088dd6e794d6c6f86e775e4d

SHA1
33a0f6e3b3649c1c45108bd47688d72e4e6c3de6

SHA256
d395be85bfff242f40354da4769ab993ee19f00ee50bef9af2d7886f2d304231

SHA512
817e73f60cf6aa8f936bf0b8f6de87b2b54174e10989cb2e9e903bd369314bf885a18eba9d81b3f65f1506056216f8a832dac6a32b4d1422b05e72efb0e2c5c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6b7c2b00468fe2a8f853706d3cc3ff8a

SHA1
8c8e34458213686c7913d90fd4ae454070a9a22f

SHA256
9ad96b07fbad33a4321da5e5c17408c722d2bcdd09e7d9e0f36b531ea1ba2fa4

SHA512
61505c5ca08511221e47b74f7f819147a46d25a0b0eed03ce74fdf32b2a87df7bc4fa0939cbb8ab73893aeb1cb7db0cb0515d683487fc00ecd91c6b53432c925

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
80a469aac7bab6aa99d127a6fd74c0be

SHA1
0d132e394e632490dc98b91c28a2becbb577e04e

SHA256
9b65939ca158a4d5a98d2b989149dc213c3e87271d28b5e3b457c62f1593152a

SHA512
51b152fcce978c13b4f28564cf34b220ac79a0e47b10f75b0c85010d9dada95934e1ada9d7ef9819e328f3bda551ee8514e52c95728a7c0182a44ac444cc3d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
8871ab2faa9d46021adccfca657fd8c8

SHA1
4377363e4144c22aae2c50c3074a7cb857773f92

SHA256
03bebe4749f19147873d30e4a8a097914fde4ee933ea52ec1448338713bc2cdd

SHA512
77b16641c7886d04ac9a3d43dc9e9e6101eda5c6fa7a8f5c47b8711f9238b72172e13fa82437cf84eb820ced0be3d09fd3f0c53684c9d8608d9fce369bf4110f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request