hxxps://click[.]pstmrk[.]it/3s/heartandstrokerideforheart[.]crowdchange[.]ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%257CParesh_Mistry%2540manulife[.]com/z9pU/LMK1AQ/AQ/ddd32eee-9d07-4c82-af81-d8bc50ea6140/1/YYY-cqlOQD

Analysis

max time kernel
59s
max time network
59s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22/04/2024, 15:36 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://click.pstmrk.it/3s/heartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%257CParesh_Mistry%2540manulife.com/z9pU/LMK1AQ/AQ/ddd32eee-9d07-4c82-af81-d8bc50ea6140/1/YYY-cqlOQD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582738316475803"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe
Token: SeShutdownPrivilege	3580	chrome.exe
Token: SeCreatePagefilePrivilege	3580	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe
3580	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 1004	3580	chrome.exe	74
PID 3580 wrote to memory of 1004	3580	chrome.exe	74
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 3140	3580	chrome.exe	76
PID 3580 wrote to memory of 4584	3580	chrome.exe	77
PID 3580 wrote to memory of 4584	3580	chrome.exe	77
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78
PID 3580 wrote to memory of 1932	3580	chrome.exe	78

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.pstmrk.it/3s/heartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%257CParesh_Mistry%2540manulife.com/z9pU/LMK1AQ/AQ/ddd32eee-9d07-4c82-af81-d8bc50ea6140/1/YYY-cqlOQD
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8964d9758,0x7ff8964d9768,0x7ff8964d9778
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4732 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3640 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5056 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5112 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:8
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1844,i,13355804261883976768,16945652151138197957,131072 /prefetch:8
  2⤵
  PID:2132

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4360

Network

DNS

click.pstmrk.it

chrome.exe

Remote address:

8.8.8.8:53

Request

click.pstmrk.it

IN A

Response

click.pstmrk.it

IN A

54.229.131.161

click.pstmrk.it

IN A

34.254.18.111

click.pstmrk.it

IN A

52.211.254.44
DNS

heartandstrokerideforheart.crowdchange.ca

chrome.exe

Remote address:

8.8.8.8:53

Request

heartandstrokerideforheart.crowdchange.ca

IN A

Response

heartandstrokerideforheart.crowdchange.ca

IN CNAME

dualstack.t.sni.global.fastly.net

dualstack.t.sni.global.fastly.net

IN A

151.101.3.52

dualstack.t.sni.global.fastly.net

IN A

151.101.67.52

dualstack.t.sni.global.fastly.net

IN A

151.101.131.52

dualstack.t.sni.global.fastly.net

IN A

151.101.195.52
GET

https://heartandstrokerideforheart.crowdchange.ca/auth/reset/29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /auth/reset/29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com HTTP/2.0
host: heartandstrokerideforheart.crowdchange.ca
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

x-ratelimit-limit: 10
cache-control: max-age=0, public
x-content-type-options: nosniff
x-xss-protection: 0
permissions-policy: accelerometer=()
content-type: text/html; charset=UTF-8
set-cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D; expires=Mon, 29 Apr 2024 15:37:05 GMT; Max-Age=604800; path=/; domain=.crowdchange.ca; secure; samesite=lax
set-cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D; expires=Mon, 29 Apr 2024 15:37:05 GMT; Max-Age=604800; path=/; domain=.crowdchange.ca; secure; httponly; samesite=lax
x-ratelimit-remaining: 9
accept-ranges: bytes
x-frame-options: sameorigin
etag: "cbc8d1bb93ffb2bee14271a608aef0d2"
content-security-policy: base-uri 'self'
server: unknown
referrer-policy: strict-origin-when-cross-origin
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-yul1970025-YUL, cache-yul1970043-YUL, cache-lcy-eglc8600091-LCY
x-cache: MISS, MISS, MISS
x-cache-hits: 0, 0, 0
x-timer: S1713800225.382332,VS0,VE204
vary: Accept, Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 19936
GET

https://cdn.crowdchange.ca/build/styles.ae4632c69bbe13de.css

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /build/styles.ae4632c69bbe13de.css HTTP/2.0
host: cdn.crowdchange.ca
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: text/css,*/*;q=0.1
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D
cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 19:28:55 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-amz-meta-version: 2024.19.9
x-amz-version-id: Koi2BxlMmVU2meoGXj.J9NAZSfFhETNe
cache-control: public,max-age=36500000,immutable
etag: "3b3f104a40b5b5b54702290dc4257335"
x-amz-request-id: XGD8VNR61FK92QT7
x-amz-id-2: BvKFSgAIxvIv/icn++e/Kl5FWZ7yHCZ1YT/l3ERprO70Hu8zODqbTLvvVtUjbAmfCwHQeiCyApA=
content-encoding: br
access-control-allow-origin: *
accept-ranges: bytes
age: 184434
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-lga21978-LGA, cache-lga21972-LGA, cache-lcy-eglc8600091-LCY
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 31, 0
x-timer: S1713800226.722697,VS0,VE1
vary: Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 32789
GET

https://cdn.crowdchange.ca/build/polyfills.e86d88f2ef61a8d3.js

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /build/polyfills.e86d88f2ef61a8d3.js HTTP/2.0
host: cdn.crowdchange.ca
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D
cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 19:28:56 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-amz-meta-version: 2024.19.9
x-amz-version-id: z0odGmbOZn8yDmW1zlpob6Zsh0X.ilYN
cache-control: public,max-age=36500000,immutable
etag: "2f53b33e96ca5e4fc70f6fac8b60d6e8"
x-amz-request-id: XGDESAWEK11PXEJT
x-amz-id-2: F3cKs+uOeqQm861se/gaTLtsjEbqC3IfUkcYGCs/jbxUD7pdcma+q5jI+sR04Vm9YXXfEhHiekCZF87akD9kLR/ppgmO4Wv7pQhqwe9/uBQ=
content-encoding: br
access-control-allow-origin: *
accept-ranges: bytes
age: 184434
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-lga21983-LGA, cache-lga21930-LGA, cache-lcy-eglc8600091-LCY
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 31, 0
x-timer: S1713800226.722048,VS0,VE2
vary: Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 92346
GET

https://cdn.crowdchange.ca/build/scripts.df09a65eed54167b.js

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /build/scripts.df09a65eed54167b.js HTTP/2.0
host: cdn.crowdchange.ca
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D
cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D

Response

HTTP/2.0 200

content-type: application/javascript
cache-control: public,max-age=36500000,immutable
x-amz-meta-version: 2024.16.4
etag: "9a40841d579176d24c0794a3c9c3dfba"
x-amz-version-id: GvUO.pMY.qzfewf7YKCReChCgZUza85Y
x-amz-server-side-encryption: AES256
x-amz-request-id: NK0AMNDKY2DG87F2
last-modified: Wed, 10 Apr 2024 11:32:40 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
server: AmazonS3
x-amz-id-2: KmRRxVbg4hfXIzh2KiNChB7OCQpc70A/NZISYR7QS5UazYhLpfqAjh+n2ILJTkt/ebdufgj4hYU=
content-encoding: br
access-control-allow-origin: *
accept-ranges: bytes
age: 1050034
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-lga21965-LGA, cache-lga21957-LGA, cache-lcy-eglc8600091-LCY
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 31, 0
x-timer: S1713800226.722588,VS0,VE1
vary: Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 280
GET

https://cdn.crowdchange.ca/build/manifest.3e26cd751c57975c.js

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /build/manifest.3e26cd751c57975c.js HTTP/2.0
host: cdn.crowdchange.ca
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D
cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 19:29:48 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-amz-meta-version: 2024.19.9
x-amz-version-id: RGREHzsCy_ULbDFWcdKOXZ6gM2PeUquJ
cache-control: public,max-age=36500000,immutable
etag: "c5450ba47d9a3d6a7434aaeffc32e983"
x-amz-request-id: XGD4NZZTPFEWVV8C
x-amz-id-2: YSmu6Zl/EMQcP5LTDHt7z37CUgflKarDi6B8jcUYMFBJZ720SrlIr3OKkfFB3lgqIpmWzoYIUF0=
content-encoding: br
access-control-allow-origin: *
accept-ranges: bytes
age: 184434
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-lga21934-LGA, cache-lga21977-LGA, cache-lcy-eglc8600091-LCY
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 30, 0
x-timer: S1713800226.723120,VS0,VE1
vary: Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2572
GET

https://cdn.crowdchange.ca/build/ckeditor.3106ec04f13ba51b.js

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /build/ckeditor.3106ec04f13ba51b.js HTTP/2.0
host: cdn.crowdchange.ca
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D
cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D

Response

HTTP/2.0 200

content-type: application/javascript
cache-control: public,max-age=36500000,immutable
x-amz-meta-version: 2024.16.4
etag: "a5fa5d890509dd56d83abe7bbda3424c"
x-amz-version-id: T8uQNZ79saGycUGSwaLFEvg9t3JGMGA5
x-amz-server-side-encryption: AES256
x-amz-request-id: NK00TP2Z9Y2BP8H4
last-modified: Wed, 10 Apr 2024 11:32:35 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
server: AmazonS3
x-amz-id-2: kgVxh5W9YBv9T71y/lSw915nrM+YZCzK7Lv6zBhmjsdo5/2ej/8Cbo9TZoPtxvUiffTOlwEqYq8=
content-encoding: br
access-control-allow-origin: *
accept-ranges: bytes
age: 1050034
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-lga21966-LGA, cache-lga21965-LGA, cache-lcy-eglc8600091-LCY
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 31, 0
x-timer: S1713800226.723430,VS0,VE1
vary: Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2576
GET

https://cdn.crowdchange.ca/build/vendor.9c866481b550d04e.js

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /build/vendor.9c866481b550d04e.js HTTP/2.0
host: cdn.crowdchange.ca
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D
cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 19:29:43 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-amz-meta-version: 2024.19.9
x-amz-version-id: FojCjNcAAwWAeH20FJakuzT2I27kiGGR
cache-control: public,max-age=36500000,immutable
etag: "5cd3a1c6340afa1198d6010256abe66f"
x-amz-request-id: XGD35RVZBWTBVMZP
x-amz-id-2: dfOwcYdGKb3TsCdIPR6ZjDLkuv2BmeOvK0fujxqLrpMDPZnrpTmBZV2r94Itb8WR+PzzvqBbvUMtT+n5NUAWSEMRQZp3yHKpv5gczpj4uf4=
content-encoding: br
access-control-allow-origin: *
accept-ranges: bytes
age: 184434
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-lga21939-LGA, cache-lga21929-LGA, cache-lcy-eglc8600091-LCY
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 31, 0
x-timer: S1713800226.723116,VS0,VE2
vary: Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 299645
GET

https://cdn.crowdchange.ca/build/ckeditorFr.11bb350b334d0ca6.js

chrome.exe

Remote address:

151.101.3.52:443

Request

GET /build/ckeditorFr.11bb350b334d0ca6.js HTTP/2.0
host: cdn.crowdchange.ca
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: XSRF-TOKEN=eyJpdiI6IjRVY3dkbXJ0RnluYzlMZjdOTDk4TXc9PSIsInZhbHVlIjoibTFseWlTRkhRcE5VZm9XYVN5MlFvR1ZzdDlnNXI4ZEszZ1hTelJwUFFueExqcmo5YmZEVVUrVFJZeUQxNEpSK0xlQllVZXdER21rcjRacXFycUU1UFI4d1R6ak9tUXR5VldYRlhyeW5za0dIakkwLzl5TGFCR1NSNGEzdVFLQUYiLCJtYWMiOiJmNTI4NGYxZmMzNTk5NGVkZTE3YjhjYmI1NDFiYmZkM2Y3N2JiNmQyODc1YWM1YTU4Y2QzOWRlZDhkMGQyOWQzIiwidGFnIjoiIn0%3D
cookie: ccp_sid=eyJpdiI6IkJxaFgzT3l2RWpPVERQVm1jY1NjS3c9PSIsInZhbHVlIjoiWGFjaXkvL2d1V0JQYnlaNmpEN3ZGdE9laHdubEZweGJBWDh4bGxNcnpJejQ5aTM2UW9tanFXR1Y5M1Zackpqazg2SEtMcDBHVXM4T0c1Zjc5VUtDZkgzTmp0eHFGVDdabzM0Q2Y0MG5MRUtST0FWdEkvYUxYem5ic1RNVWxrenciLCJtYWMiOiIxODcwNzU5YWE1YzU2NzBjNzJkOGU1OThkM2I1Yjg0OGQ4ZjVlMDI5Zjk5ZTZjNzM3Y2M5Yzg3Mjc2YjExNmQwIiwidGFnIjoiIn0%3D

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 19:29:53 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-amz-meta-version: 2024.19.9
x-amz-version-id: WuDIfvKxXL0IOXaMF_xVNZeGC3AWNyoT
cache-control: public,max-age=36500000,immutable
etag: "0cc7de5ceb2aeb3ae707d21697693b99"
x-amz-request-id: XGDEDJ113QFWY2BY
x-amz-id-2: 24iMV5G2HVw85S7yPpytP2Fa/Vk+c/kr8F/n3m1cF2HI9LfPISdIpu0AGP/+QXcffcMV/tA0FP0=
content-encoding: br
access-control-allow-origin: *
accept-ranges: bytes
age: 184434
date: Mon, 22 Apr 2024 15:37:05 GMT
x-served-by: cache-lga21935-LGA, cache-lga21948-LGA, cache-lcy-eglc8600091-LCY
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 31, 0
x-timer: S1713800226.723603,VS0,VE2
vary: Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1307579
DNS

161.131.229.54.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.131.229.54.in-addr.arpa

IN PTR

Response

161.131.229.54.in-addr.arpa

IN PTR

ec2-54-229-131-161 eu-west-1compute amazonawscom
DNS

46.10.230.54.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.10.230.54.in-addr.arpa

IN PTR

Response

46.10.230.54.in-addr.arpa

IN PTR

server-54-230-10-46man50r cloudfrontnet
DNS

249.197.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

249.197.17.2.in-addr.arpa

IN PTR

Response

249.197.17.2.in-addr.arpa

IN PTR

a2-17-197-249deploystaticakamaitechnologiescom
DNS

certificates.starfieldtech.com

chrome.exe

Remote address:

8.8.8.8:53

Request

certificates.starfieldtech.com

IN A

Response

certificates.starfieldtech.com

IN CNAME

sfcrl.godaddy.com.akadns.net

sfcrl.godaddy.com.akadns.net

IN A

192.124.249.31

sfcrl.godaddy.com.akadns.net

IN A

192.124.249.36

sfcrl.godaddy.com.akadns.net

IN A

192.124.249.41
GET

http://certificates.starfieldtech.com/repository/sfroot-g2.crt.cer

chrome.exe

Remote address:

192.124.249.31:80

Request

GET /repository/sfroot-g2.crt.cer HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: certificates.starfieldtech.com

Response

HTTP/1.1 200 OK

Server: Sucuri/Cloudproxy
Date: Mon, 22 Apr 2024 15:37:04 GMT
Content-Type: application/pkix-cert
Content-Length: 993
Connection: keep-alive
X-Sucuri-ID: 13031
Last-Modified: Tue, 16 Apr 2024 20:08:26 GMT
ETag: "3e1-6163c4d00a280"
Cache-Control: public, no-transform, must-revalidate
Expires: Sat, 20 Apr 2024 03:17:59 GMT
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Sucuri-Cache: HIT
Accept-Ranges: bytes
DNS

cdn.crowdchange.ca

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.crowdchange.ca

IN A

Response

cdn.crowdchange.ca

IN CNAME

dualstack.t.sni.global.fastly.net

dualstack.t.sni.global.fastly.net

IN A

151.101.3.52

dualstack.t.sni.global.fastly.net

IN A

151.101.67.52

dualstack.t.sni.global.fastly.net

IN A

151.101.131.52

dualstack.t.sni.global.fastly.net

IN A

151.101.195.52
DNS

js.stripe.com

chrome.exe

Remote address:

8.8.8.8:53

Request

js.stripe.com

IN A

Response

js.stripe.com

IN CNAME

stripecdn.map.fastly.net

stripecdn.map.fastly.net

IN A

151.101.0.176

stripecdn.map.fastly.net

IN A

151.101.64.176

stripecdn.map.fastly.net

IN A

151.101.128.176

stripecdn.map.fastly.net

IN A

151.101.192.176
DNS

cdn.givechariot.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.givechariot.com

IN A

Response

cdn.givechariot.com

IN CNAME

dng0b48xuv5zy.cloudfront.net

dng0b48xuv5zy.cloudfront.net

IN A

18.172.89.114

dng0b48xuv5zy.cloudfront.net

IN A

18.172.89.76

dng0b48xuv5zy.cloudfront.net

IN A

18.172.89.79

dng0b48xuv5zy.cloudfront.net

IN A

18.172.89.100
DNS

crowdchange-ca.imgix.net

chrome.exe

Remote address:

8.8.8.8:53

Request

crowdchange-ca.imgix.net

IN A

Response

crowdchange-ca.imgix.net

IN CNAME

dualstack.com.imgix.map.fastly.net

dualstack.com.imgix.map.fastly.net

IN A

151.101.2.208

dualstack.com.imgix.map.fastly.net

IN A

151.101.66.208

dualstack.com.imgix.map.fastly.net

IN A

151.101.130.208

dualstack.com.imgix.map.fastly.net

IN A

151.101.194.208
GET

https://cdn.givechariot.com/chariot-connect.umd.js

chrome.exe

Remote address:

18.172.89.114:443

Request

GET /chariot-connect.umd.js HTTP/2.0
host: cdn.givechariot.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
date: Mon, 22 Apr 2024 14:27:05 GMT
last-modified: Mon, 22 Apr 2024 01:48:52 GMT
etag: W/"60d9dc56316e3b769abc8bd3004b7a41"
x-amz-server-side-encryption: AES256
x-amz-version-id: s0SgRywDF2G5w9VU4kP8oCn.mndhjTVl
server: AmazonS3
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 90a04b21046e94f26928809a15bdd7ac.cloudfront.net (CloudFront)
x-amz-cf-pop: MAN51-P1
x-amz-cf-id: f2U5IQ80IagJrLFWsux_g4gH672EGH8RrW22ojnyAdXtdX8D82Ck3g==
age: 4202
cache-control: no-cache,no-store,must-revalidate,max-age=0
GET

https://js.stripe.com/v3/

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/ HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 21:28:14 GMT
etag: "9da8ff7a51979cbce3c7c2acae197be9"
cache-control: max-age=60
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:05 GMT
via: 1.1 varnish
age: 11
x-request-id: 0b469fbf-ca70-41f6-a53c-9e005188bc8e
x-served-by: cache-lcy-eglc8600071-LCY
x-cache: HIT
x-cache-hits: 5
vary: Accept-Encoding
timing-allow-origin: *
content-length: 170400
GET

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 11 Nov 2022 20:25:37 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
cache-control: max-age=31536000
content-type: text/html; charset=utf-8
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:09 GMT
via: 1.1 varnish
age: 1225894
x-request-id: ff7f6b86-e677-4a38-8f4a-335d15905b61
x-served-by: cache-lcy-eglc8600071-LCY
x-cache: HIT
x-cache-hits: 1077902
vary: Accept-Encoding
timing-allow-origin: *
content-length: 154
GET

https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 11 Nov 2022 20:25:36 GMT
etag: "d96c709017743c0759cf3853d1806ba5"
cache-control: max-age=31536000
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:09 GMT
via: 1.1 varnish
age: 1429711
x-request-id: 367c2316-06a8-4f5f-9a52-46a1fb2b2047
x-served-by: cache-lcy-eglc8600071-LCY
x-cache: HIT
x-cache-hits: 1011351
vary: Accept-Encoding
timing-allow-origin: *
content-length: 315
GET

https://js.stripe.com/v3/controller-with-preconnect-f5282affe3c1d903364a837590431600.html

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/controller-with-preconnect-f5282affe3c1d903364a837590431600.html HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 20:52:18 GMT
etag: "f5282affe3c1d903364a837590431600"
cache-control: max-age=60, stale-while-revalidate=900
content-type: text/html; charset=utf-8
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:09 GMT
via: 1.1 varnish
age: 23
x-request-id: fc99dc42-e434-4bb4-b1c9-a73c157f8450
x-served-by: cache-lcy-eglc8600071-LCY
x-cache: HIT
x-cache-hits: 29
vary: Accept-Encoding
timing-allow-origin: *
content-length: 229
GET

https://js.stripe.com/v3/fingerprinted/js/shared-8c3a12bfd44bc3812e112f739812ca84.js

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/fingerprinted/js/shared-8c3a12bfd44bc3812e112f739812ca84.js HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://js.stripe.com/v3/controller-with-preconnect-f5282affe3c1d903364a837590431600.html
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 20:52:31 GMT
etag: "ee6c77a8e04155ee539555c921d69d18"
cache-control: max-age=31536000
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:09 GMT
via: 1.1 varnish
age: 240013
x-request-id: c9ea94ae-5738-4321-8dee-a768909e9416
x-served-by: cache-lcy-eglc8600071-LCY
x-cache: HIT
x-cache-hits: 95048
vary: Accept-Encoding
timing-allow-origin: *
content-length: 137155
GET

https://js.stripe.com/v3/fingerprinted/js/controller-f6b791467bea10c838c9f5429acef4dd.js

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/fingerprinted/js/controller-f6b791467bea10c838c9f5429acef4dd.js HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://js.stripe.com/v3/controller-with-preconnect-f5282affe3c1d903364a837590431600.html
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 20:52:29 GMT
etag: "3bb286beca247f1d509a4d417cd8d881"
cache-control: max-age=31536000
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:09 GMT
via: 1.1 varnish
age: 240013
x-request-id: 5b445e09-3339-4402-9572-42bc86bbb216
x-served-by: cache-lcy-eglc8600071-LCY
x-cache: HIT
x-cache-hits: 93988
vary: Accept-Encoding
timing-allow-origin: *
content-length: 192337
GET

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Thu, 21 Dec 2023 18:13:43 GMT
etag: "96f5b26d366f47393b3ff36fe7471474"
cache-control: max-age=31536000
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:16 GMT
via: 1.1 varnish
age: 1216363
x-request-id: 515adbbe-6f46-48d7-9fab-c31a144f9f61
x-served-by: cache-lcy-eglc8600071-LCY
x-cache: HIT
x-cache-hits: 183181
vary: Accept-Encoding
timing-allow-origin: *
content-length: 127
DNS

52.3.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

52.3.101.151.in-addr.arpa

IN PTR

Response
DNS

31.249.124.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

31.249.124.192.in-addr.arpa

IN PTR

Response

31.249.124.192.in-addr.arpa

IN PTR

cloudproxy10031sucurinet
DNS

10.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.180.250.142.in-addr.arpa

IN PTR

Response

10.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f101e100net
DNS

35.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.200.250.142.in-addr.arpa

IN PTR

Response

35.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f31e100net
DNS

40.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

40.200.250.142.in-addr.arpa

IN PTR

Response

40.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f81e100net
DNS

176.0.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

176.0.101.151.in-addr.arpa

IN PTR

Response
DNS

114.89.172.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

114.89.172.18.in-addr.arpa

IN PTR

Response

114.89.172.18.in-addr.arpa

IN PTR

server-18-172-89-114man51r cloudfrontnet
DNS

208.2.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

208.2.101.151.in-addr.arpa

IN PTR

Response
DNS

226.21.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.21.18.104.in-addr.arpa

IN PTR

Response
DNS

platform.twitter.com

chrome.exe

Remote address:

8.8.8.8:53

Request

platform.twitter.com

IN A

Response

platform.twitter.com

IN CNAME

cs472.wac.edgecastcdn.net

cs472.wac.edgecastcdn.net

IN CNAME

cs1-apr-8315.wac.edgecastcdn.net

cs1-apr-8315.wac.edgecastcdn.net

IN CNAME

wac.apr-8315.edgecastdns.net

wac.apr-8315.edgecastdns.net

IN CNAME

cs1-lb-eu.8315.ecdns.net

cs1-lb-eu.8315.ecdns.net

IN CNAME

cs41.wac.edgecastcdn.net

cs41.wac.edgecastcdn.net

IN A

93.184.220.66
GET

https://platform.twitter.com/widgets.js

chrome.exe

Remote address:

93.184.220.66:443

Request

GET /widgets.js HTTP/1.1
Host: platform.twitter.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: */*
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: script
Referer: https://heartandstrokerideforheart.crowdchange.ca/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3000
Age: 1291
Cache-Control: public, max-age=1800
Content-Type: application/javascript; charset=utf-8
Date: Mon, 22 Apr 2024 15:37:06 GMT
Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (lhd/35AA)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
x-amz-server-side-encryption: AES256
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 27597
GET

https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca

chrome.exe

Remote address:

93.184.220.66:443

Request

GET /widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca HTTP/1.1
Host: platform.twitter.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://heartandstrokerideforheart.crowdchange.ca/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 2464130
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 22 Apr 2024 15:37:09 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (lhd/359E)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
x-amz-server-side-encryption: AES256
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105429
DNS

66.220.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

66.220.184.93.in-addr.arpa

IN PTR

Response
DNS

connect.facebook.net

chrome.exe

Remote address:

8.8.8.8:53

Request

connect.facebook.net

IN A

Response

connect.facebook.net

IN CNAME

scontent.xx.fbcdn.net

scontent.xx.fbcdn.net

IN A

163.70.151.21
DNS

sessions.bugsnag.com

chrome.exe

Remote address:

8.8.8.8:53

Request

sessions.bugsnag.com

IN A

Response

sessions.bugsnag.com

IN A

35.190.88.7
OPTIONS

https://sessions.bugsnag.com/

chrome.exe

Remote address:

35.190.88.7:443

Request

OPTIONS / HTTP/2.0
host: sessions.bugsnag.com
accept: */*
access-control-request-method: POST
access-control-request-headers: bugsnag-api-key,bugsnag-payload-version,bugsnag-sent-at,content-type
origin: https://heartandstrokerideforheart.crowdchange.ca
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

21.151.70.163.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.151.70.163.in-addr.arpa

IN PTR

Response

21.151.70.163.in-addr.arpa

IN PTR

xx-fbcdn-shv-02-lhr6fbcdnnet
DNS

ws-mt1.pusher.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ws-mt1.pusher.com

IN A

Response

ws-mt1.pusher.com

IN CNAME

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

34.232.238.221

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

34.226.23.254

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

3.235.210.167

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

54.88.194.95

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

52.5.38.178

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

54.243.190.192

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

3.213.107.173

socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com

IN A

52.55.5.17
DNS

m.stripe.network

chrome.exe

Remote address:

8.8.8.8:53

Request

m.stripe.network

IN A

Response

m.stripe.network

IN CNAME

d1tcqh4bio8cty.cloudfront.net

d1tcqh4bio8cty.cloudfront.net

IN A

3.162.20.80

d1tcqh4bio8cty.cloudfront.net

IN A

3.162.20.102

d1tcqh4bio8cty.cloudfront.net

IN A

3.162.20.128

d1tcqh4bio8cty.cloudfront.net

IN A

3.162.20.35
GET

https://m.stripe.network/inner.html

chrome.exe

Remote address:

3.162.20.80:443

Request

GET /inner.html HTTP/2.0
host: m.stripe.network
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://js.stripe.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/html; charset=utf-8
content-length: 930
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
accept-ranges: bytes
server: Cloudfront
date: Mon, 22 Apr 2024 15:36:29 GMT
cache-control: max-age=300, public
etag: "06bfcd88af438673a8bf9b845a11aa6e"
vary: Accept-Encoding, Origin
via: 1.1 690e43471aef3bb47bb08a72f71583a8.cloudfront.net (CloudFront)
age: 41
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-pop: MAN51-P3
x-amz-cf-id: X-jYoZIm5_lLliFwst-xeAfTS16A_17jMKW80toGtvQIGCBzkICsHA==
GET

https://m.stripe.network/out-4.5.43.js

chrome.exe

Remote address:

3.162.20.80:443

Request

GET /out-4.5.43.js HTTP/2.0
host: m.stripe.network
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://m.stripe.network/inner.html
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript; charset=utf-8
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
server: Cloudfront
content-encoding: br
date: Mon, 22 Apr 2024 15:32:16 GMT
cache-control: max-age=300, public
etag: W/"69cb7809b5011312e716f29b3d19dce6"
vary: Accept-Encoding, Origin
via: 1.1 690e43471aef3bb47bb08a72f71583a8.cloudfront.net (CloudFront)
age: 294
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-pop: MAN51-P3
x-amz-cf-id: Fz9TKbN7VwT3CAkFSiV3m7lfE7NFwKjq-lI3rTGee4g3VJ9DP8vQIQ==
DNS

analytics.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

analytics.google.com

IN A

Response

analytics.google.com

IN A

216.58.204.78
DNS

stats.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

stats.g.doubleclick.net

IN A

Response

stats.g.doubleclick.net

IN A

64.233.184.157

stats.g.doubleclick.net

IN A

64.233.184.154

stats.g.doubleclick.net

IN A

64.233.184.155

stats.g.doubleclick.net

IN A

64.233.184.156
DNS

googleads.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A

Response

googleads.g.doubleclick.net

IN A

142.250.200.2
POST

https://analytics.google.com/g/collect?v=2&tid=G-CMKF97WDFL&gtm=45je44h0v9103827295za200&_p=1713800228310&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=2093093195.1713800229&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713800229&sct=1&seg=0&dl=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com&dt=Heart%20%26%20Stroke%20Ride%20for%20Heart&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=5613

chrome.exe

Remote address:

216.58.204.78:443

Request

POST /g/collect?v=2&tid=G-CMKF97WDFL&gtm=45je44h0v9103827295za200&_p=1713800228310&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=2093093195.1713800229&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713800229&sct=1&seg=0&dl=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com&dt=Heart%20%26%20Stroke%20Ride%20for%20Heart&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=5613 HTTP/2.0
host: analytics.google.com
content-length: 0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://heartandstrokerideforheart.crowdchange.ca
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
POST

https://analytics.google.com/g/collect?v=2&tid=G-RW7D5M2J52&gtm=45je44h0v9163957040z86295854za200&_p=1713800228310&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=2093093195.1713800229&ul=en-us&sr=1280x720&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com&sid=1713800229&sct=1&seg=0&dt=Heart%20%26%20Stroke%20Ride%20for%20Heart&en=page_view&_fv=1&_ss=1&tfd=5738

chrome.exe

Remote address:

216.58.204.78:443

Request

POST /g/collect?v=2&tid=G-RW7D5M2J52&gtm=45je44h0v9163957040z86295854za200&_p=1713800228310&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=2093093195.1713800229&ul=en-us&sr=1280x720&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com&sid=1713800229&sct=1&seg=0&dt=Heart%20%26%20Stroke%20Ride%20for%20Heart&en=page_view&_fv=1&_ss=1&tfd=5738 HTTP/2.0
host: analytics.google.com
content-length: 0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://heartandstrokerideforheart.crowdchange.ca
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
POST

https://stats.g.doubleclick.net/g/collect?v=2&tid=G-CMKF97WDFL&cid=2093093195.1713800229&gtm=45je44h0v9103827295za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0

chrome.exe

Remote address:

64.233.184.157:443

Request

POST /g/collect?v=2&tid=G-CMKF97WDFL&cid=2093093195.1713800229&gtm=45je44h0v9103827295za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0 HTTP/2.0
host: stats.g.doubleclick.net
content-length: 0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://heartandstrokerideforheart.crowdchange.ca
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
POST

https://stats.g.doubleclick.net/g/collect?v=2&tid=G-RW7D5M2J52&cid=2093093195.1713800229&gtm=45je44h0v9163957040z86295854za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0

chrome.exe

Remote address:

64.233.184.157:443

Request

POST /g/collect?v=2&tid=G-RW7D5M2J52&cid=2093093195.1713800229&gtm=45je44h0v9163957040z86295854za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0 HTTP/2.0
host: stats.g.doubleclick.net
content-length: 0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://heartandstrokerideforheart.crowdchange.ca
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

api.stripe.com

chrome.exe

Remote address:

8.8.8.8:53

Request

api.stripe.com

IN A

Response

api.stripe.com

IN A

34.241.59.225

api.stripe.com

IN A

34.250.29.31

api.stripe.com

IN A

34.250.89.120
GET

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1003371904/?random=1713800229183&cv=11&fst=1713800229183&bg=ffffff&guid=ON&async=1&gtm=45be44h0v895064540z86295854za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=720&url=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%257CParesh_Mistry%2540manulife.com&hn=www.googleadservices.com&frm=0&tiba=Heart%20%26%20Stroke%20Ride%20for%20Heart&npa=0&pscdl=noapi&auid=1235326913.1713800229&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&fdr=QA&rfmt=3&fmt=4

chrome.exe

Remote address:

142.250.200.2:443

Request

GET /pagead/viewthroughconversion/1003371904/?random=1713800229183&cv=11&fst=1713800229183&bg=ffffff&guid=ON&async=1&gtm=45be44h0v895064540z86295854za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=720&url=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%257CParesh_Mistry%2540manulife.com&hn=www.googleadservices.com&frm=0&tiba=Heart%20%26%20Stroke%20Ride%20for%20Heart&npa=0&pscdl=noapi&auid=1235326913.1713800229&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&fdr=QA&rfmt=3&fmt=4 HTTP/2.0
host: googleads.g.doubleclick.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://heartandstrokerideforheart.crowdchange.ca/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

content-autofill.googleapis.com

chrome.exe

Remote address:

8.8.8.8:53

Request

content-autofill.googleapis.com

IN A

Response

content-autofill.googleapis.com

IN A

142.250.200.10

content-autofill.googleapis.com

IN A

142.250.178.10

content-autofill.googleapis.com

IN A

216.58.201.106

content-autofill.googleapis.com

IN A

216.58.204.74

content-autofill.googleapis.com

IN A

172.217.169.10

content-autofill.googleapis.com

IN A

216.58.212.202

content-autofill.googleapis.com

IN A

172.217.169.74

content-autofill.googleapis.com

IN A

142.250.179.234

content-autofill.googleapis.com

IN A

142.250.180.10

content-autofill.googleapis.com

IN A

142.250.187.202

content-autofill.googleapis.com

IN A

142.250.187.234

content-autofill.googleapis.com

IN A

142.250.200.42

content-autofill.googleapis.com

IN A

172.217.16.234
DNS

www.facebook.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.facebook.com

IN A

Response

www.facebook.com

IN CNAME

star-mini.c10r.facebook.com

star-mini.c10r.facebook.com

IN A

163.70.151.35
DNS

syndication.twitter.com

chrome.exe

Remote address:

8.8.8.8:53

Request

syndication.twitter.com

IN A

Response

syndication.twitter.com

IN A

104.244.42.72
GET

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAnuZEMZq2jo-hIFDc5BTHo=?alt=proto

chrome.exe

Remote address:

142.250.200.10:443

Request

GET /v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAnuZEMZq2jo-hIFDc5BTHo=?alt=proto HTTP/2.0
host: content-autofill.googleapis.com
x-goog-encode-response-if-executable: base64
x-goog-api-key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
x-client-data: COiBywE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://syndication.twitter.com/settings?session_id=67b57b2086164d016f53c6db8616fed2453ee40c

chrome.exe

Remote address:

104.244.42.72:443

Request

GET /settings?session_id=67b57b2086164d016f53c6db8616fed2453ee40c HTTP/2.0
host: syndication.twitter.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://platform.twitter.com
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://platform.twitter.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 22 Apr 2024 15:37:09 GMT
perf: 7402827104
vary: Origin
server: tsa_f
content-type: application/json; charset=utf-8
cache-control: must-revalidate, max-age=600
last-modified: Mon, 22 Apr 2024 15:37:10 GMT
content-length: 363
content-encoding: gzip
x-transaction-id: 6353827e249d4051
strict-transport-security: max-age=631138519
access-control-allow-origin: https://platform.twitter.com
access-control-allow-credentials: true
x-response-time: 109
x-connection-hash: 5fe59de1488d4d2e27b5173d6ffd2f38fef56bd0e86dc6933be7e1abc4ee22ce
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

216.58.204.68
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A
DNS

7.88.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

7.88.190.35.in-addr.arpa

IN PTR

Response

7.88.190.35.in-addr.arpa

IN PTR

78819035bcgoogleusercontentcom
DNS

221.238.232.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

221.238.232.34.in-addr.arpa

IN PTR

Response

221.238.232.34.in-addr.arpa

IN PTR

ec2-34-232-238-221 compute-1 amazonawscom
DNS

80.20.162.3.in-addr.arpa

Remote address:

8.8.8.8:53

Request

80.20.162.3.in-addr.arpa

IN PTR

Response

80.20.162.3.in-addr.arpa

IN PTR

server-3-162-20-80man51r cloudfrontnet
DNS

78.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

78.204.58.216.in-addr.arpa

IN PTR

Response

78.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f781e100net

78.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f14�H

78.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f14�H
DNS

2.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.200.250.142.in-addr.arpa

IN PTR

Response

2.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f21e100net
DNS

157.184.233.64.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.184.233.64.in-addr.arpa

IN PTR

Response

157.184.233.64.in-addr.arpa

IN PTR

wa-in-f1571e100net
DNS

10.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.200.250.142.in-addr.arpa

IN PTR

Response

10.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f101e100net
DNS

225.59.241.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

225.59.241.34.in-addr.arpa

IN PTR

Response

225.59.241.34.in-addr.arpa

IN PTR

api-34-241-59-225stripecom
DNS

35.151.70.163.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.151.70.163.in-addr.arpa

IN PTR

Response

35.151.70.163.in-addr.arpa

IN PTR

edge-star-mini-shv-02-lhr6facebookcom
DNS

72.42.244.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

72.42.244.104.in-addr.arpa

IN PTR

Response
GET

https://js.stripe.com/v3/.deploy_status_henson.json

chrome.exe

Remote address:

151.101.0.176:443

Request

GET /v3/.deploy_status_henson.json HTTP/2.0
host: js.stripe.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
accept: application/json
content-type: application/x-www-form-urlencoded
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://js.stripe.com/v3/controller-with-preconnect-f5282affe3c1d903364a837590431600.html
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 19 Apr 2024 21:31:27 GMT
etag: "9a401ef88a9bf9407746ac17d268a7cf"
cache-control: max-age=60
content-type: application/json
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Mon, 22 Apr 2024 15:37:10 GMT
via: 1.1 varnish
age: 57
x-request-id: b32f3d35-17a8-4815-bb26-ddbda3accf4c
x-served-by: cache-lcy-eglc8600084-LCY
x-cache: HIT
x-cache-hits: 119
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
content-length: 297
DNS

m.stripe.com

chrome.exe

Remote address:

8.8.8.8:53

Request

m.stripe.com

IN A

Response

m.stripe.com

IN A

44.240.235.135

m.stripe.com

IN A

44.239.252.40

m.stripe.com

IN A

44.237.125.219

m.stripe.com

IN A

54.213.45.60

m.stripe.com

IN A

44.237.105.128

m.stripe.com

IN A

44.233.205.94

m.stripe.com

IN A

44.237.49.162

m.stripe.com

IN A

44.237.131.121
DNS

r.stripe.com

chrome.exe

Remote address:

8.8.8.8:53

Request

r.stripe.com

IN A

Response

r.stripe.com

IN A

54.186.23.98

r.stripe.com

IN A

54.187.119.242

r.stripe.com

IN A

54.187.159.182
DNS

135.235.240.44.in-addr.arpa

Remote address:

8.8.8.8:53

Request

135.235.240.44.in-addr.arpa

IN PTR

Response

135.235.240.44.in-addr.arpa

IN PTR

ec2-44-240-235-135 us-west-2compute amazonawscom
DNS

68.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.204.58.216.in-addr.arpa

IN PTR

Response

68.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f41e100net

68.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f4�G

68.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f68�G
DNS

98.23.186.54.in-addr.arpa

Remote address:

8.8.8.8:53

Request

98.23.186.54.in-addr.arpa

IN PTR

Response

98.23.186.54.in-addr.arpa

IN PTR

ip-54-186-23-98stripecom

54.229.131.161:443

click.pstmrk.it

tls

chrome.exe

1.1kB
5.9kB
9
9
54.229.131.161:443

click.pstmrk.it

tls

chrome.exe

2.0kB
6.6kB
13
13
151.101.3.52:443

heartandstrokerideforheart.crowdchange.ca

tls

chrome.exe

902 B
685 B
6
5
151.101.3.52:443

https://cdn.crowdchange.ca/build/ckeditorFr.11bb350b334d0ca6.js

tls, http2

chrome.exe

41.9kB
1.8MB
777
1331

HTTP Request

GET https://heartandstrokerideforheart.crowdchange.ca/auth/reset/29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com

HTTP Response

200

HTTP Request

GET https://cdn.crowdchange.ca/build/styles.ae4632c69bbe13de.css

HTTP Request

GET https://cdn.crowdchange.ca/build/polyfills.e86d88f2ef61a8d3.js

HTTP Request

GET https://cdn.crowdchange.ca/build/scripts.df09a65eed54167b.js

HTTP Request

GET https://cdn.crowdchange.ca/build/manifest.3e26cd751c57975c.js

HTTP Request

GET https://cdn.crowdchange.ca/build/ckeditor.3106ec04f13ba51b.js

HTTP Request

GET https://cdn.crowdchange.ca/build/vendor.9c866481b550d04e.js

HTTP Request

GET https://cdn.crowdchange.ca/build/ckeditorFr.11bb350b334d0ca6.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
192.124.249.31:80

http://certificates.starfieldtech.com/repository/sfroot-g2.crt.cer

http

chrome.exe

343 B
1.7kB
4
4

HTTP Request

GET http://certificates.starfieldtech.com/repository/sfroot-g2.crt.cer

HTTP Response

200
18.172.89.114:443

https://cdn.givechariot.com/chariot-connect.umd.js

tls, http2

chrome.exe

4.9kB
125.5kB
72
100

HTTP Request

GET https://cdn.givechariot.com/chariot-connect.umd.js

HTTP Response

200
151.101.0.176:443

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js

tls, http2

chrome.exe

16.3kB
527.4kB
285
399

HTTP Request

GET https://js.stripe.com/v3/

HTTP Response

200

HTTP Request

GET https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

HTTP Response

200

HTTP Request

GET https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

HTTP Response

200

HTTP Request

GET https://js.stripe.com/v3/controller-with-preconnect-f5282affe3c1d903364a837590431600.html

HTTP Response

200

HTTP Request

GET https://js.stripe.com/v3/fingerprinted/js/shared-8c3a12bfd44bc3812e112f739812ca84.js

HTTP Request

GET https://js.stripe.com/v3/fingerprinted/js/controller-f6b791467bea10c838c9f5429acef4dd.js

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js

HTTP Response

200
151.101.2.208:443

crowdchange-ca.imgix.net

tls

chrome.exe

2.0kB
9.1kB
15
16
93.184.220.66:443

https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca

tls, http

chrome.exe

5.2kB
143.8kB
63
113

HTTP Request

GET https://platform.twitter.com/widgets.js

HTTP Response

200

HTTP Request

GET https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca

HTTP Response

200
163.70.151.21:443

connect.facebook.net

tls

chrome.exe

3.6kB
67.7kB
52
59
163.70.151.21:443

connect.facebook.net

tls

chrome.exe

897 B
2.6kB
7
5
35.190.88.7:443

https://sessions.bugsnag.com/

tls, http2

chrome.exe

1.6kB
4.9kB
11
12

HTTP Request

OPTIONS https://sessions.bugsnag.com/
34.232.238.221:443

ws-mt1.pusher.com

tls

chrome.exe

1.7kB
6.5kB
10
11
3.162.20.80:443

https://m.stripe.network/out-4.5.43.js

tls, http2

chrome.exe

2.2kB
22.5kB
21
27

HTTP Request

GET https://m.stripe.network/inner.html

HTTP Response

200

HTTP Request

GET https://m.stripe.network/out-4.5.43.js

HTTP Response

200
216.58.204.78:443

https://analytics.google.com/g/collect?v=2&tid=G-RW7D5M2J52&gtm=45je44h0v9163957040z86295854za200&_p=1713800228310&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=2093093195.1713800229&ul=en-us&sr=1280x720&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com&sid=1713800229&sct=1&seg=0&dt=Heart%20%26%20Stroke%20Ride%20for%20Heart&en=page_view&_fv=1&_ss=1&tfd=5738

tls, http2

chrome.exe

2.9kB
9.2kB
17
18

HTTP Request

POST https://analytics.google.com/g/collect?v=2&tid=G-CMKF97WDFL&gtm=45je44h0v9103827295za200&_p=1713800228310&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=2093093195.1713800229&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713800229&sct=1&seg=0&dl=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com&dt=Heart%20%26%20Stroke%20Ride%20for%20Heart&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=5613

HTTP Request

POST https://analytics.google.com/g/collect?v=2&tid=G-RW7D5M2J52&gtm=45je44h0v9163957040z86295854za200&_p=1713800228310&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=2093093195.1713800229&ul=en-us&sr=1280x720&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%7CParesh_Mistry%40manulife.com&sid=1713800229&sct=1&seg=0&dt=Heart%20%26%20Stroke%20Ride%20for%20Heart&en=page_view&_fv=1&_ss=1&tfd=5738
64.233.184.157:443

https://stats.g.doubleclick.net/g/collect?v=2&tid=G-RW7D5M2J52&cid=2093093195.1713800229&gtm=45je44h0v9163957040z86295854za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0

tls, http2

chrome.exe

2.1kB
6.7kB
16
15

HTTP Request

POST https://stats.g.doubleclick.net/g/collect?v=2&tid=G-CMKF97WDFL&cid=2093093195.1713800229&gtm=45je44h0v9103827295za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0

HTTP Request

POST https://stats.g.doubleclick.net/g/collect?v=2&tid=G-RW7D5M2J52&cid=2093093195.1713800229&gtm=45je44h0v9163957040z86295854za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
216.58.204.78:443

analytics.google.com

tls

chrome.exe

1.0kB
7.3kB
11
9
64.233.184.157:443

stats.g.doubleclick.net

tls

chrome.exe

931 B
5.0kB
9
7
142.250.200.2:443

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1003371904/?random=1713800229183&cv=11&fst=1713800229183&bg=ffffff&guid=ON&async=1&gtm=45be44h0v895064540z86295854za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=720&url=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%257CParesh_Mistry%2540manulife.com&hn=www.googleadservices.com&frm=0&tiba=Heart%20%26%20Stroke%20Ride%20for%20Heart&npa=0&pscdl=noapi&auid=1235326913.1713800229&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&fdr=QA&rfmt=3&fmt=4

tls, http2

chrome.exe

2.4kB
8.5kB
17
18

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1003371904/?random=1713800229183&cv=11&fst=1713800229183&bg=ffffff&guid=ON&async=1&gtm=45be44h0v895064540z86295854za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=720&url=https%3A%2F%2Fheartandstrokerideforheart.crowdchange.ca%2Fauth%2Freset%2F29693b09a7e56c1d43593e79779e07d3bfd8897a8b9a4fb90e1055de7f16ae53%257CParesh_Mistry%2540manulife.com&hn=www.googleadservices.com&frm=0&tiba=Heart%20%26%20Stroke%20Ride%20for%20Heart&npa=0&pscdl=noapi&auid=1235326913.1713800229&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=4.0.0&uaw=0&fdr=QA&rfmt=3&fmt=4
34.241.59.225:443

api.stripe.com

tls, http2

chrome.exe

1.0kB
4.3kB
9
10
142.250.200.10:443

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAnuZEMZq2jo-hIFDc5BTHo=?alt=proto

tls, http2

chrome.exe

1.8kB
7.0kB
14
16

HTTP Request

GET https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAnuZEMZq2jo-hIFDc5BTHo=?alt=proto
163.70.151.35:443

www.facebook.com

tls

chrome.exe

2.8kB
4.5kB
14
11
104.244.42.72:443

https://syndication.twitter.com/settings?session_id=67b57b2086164d016f53c6db8616fed2453ee40c

tls, http2

chrome.exe

1.6kB
5.0kB
10
11

HTTP Request

GET https://syndication.twitter.com/settings?session_id=67b57b2086164d016f53c6db8616fed2453ee40c

HTTP Response

200
151.101.0.176:443

https://js.stripe.com/v3/.deploy_status_henson.json

tls, http2

chrome.exe

1.6kB
6.0kB
11
13

HTTP Request

GET https://js.stripe.com/v3/.deploy_status_henson.json

HTTP Response

200
44.240.235.135:443

m.stripe.com

tls

chrome.exe

6.3kB
6.1kB
19
20
216.58.204.68:443

www.google.com

tls

chrome.exe

953 B
4.8kB
8
9
54.186.23.98:443

r.stripe.com

tls

chrome.exe

10.0kB
4.3kB
21
14

8.8.8.8:53

click.pstmrk.it

dns

chrome.exe

61 B
109 B
1
1

DNS Request

click.pstmrk.it

DNS Response

54.229.131.161

34.254.18.111

52.211.254.44
8.8.8.8:53

heartandstrokerideforheart.crowdchange.ca

dns

chrome.exe

87 B
198 B
1
1

DNS Request

heartandstrokerideforheart.crowdchange.ca

DNS Response

151.101.3.52

151.101.67.52

151.101.131.52

151.101.195.52
8.8.8.8:53

161.131.229.54.in-addr.arpa

dns

73 B
137 B
1
1

DNS Request

161.131.229.54.in-addr.arpa
8.8.8.8:53

46.10.230.54.in-addr.arpa

dns

71 B
127 B
1
1

DNS Request

46.10.230.54.in-addr.arpa
8.8.8.8:53

249.197.17.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

249.197.17.2.in-addr.arpa
8.8.8.8:53

certificates.starfieldtech.com

dns

chrome.exe

76 B
166 B
1
1

DNS Request

certificates.starfieldtech.com

DNS Response

192.124.249.31

192.124.249.36

192.124.249.41
8.8.8.8:53

cdn.crowdchange.ca

dns

chrome.exe

64 B
175 B
1
1

DNS Request

cdn.crowdchange.ca

DNS Response

151.101.3.52

151.101.67.52

151.101.131.52

151.101.195.52
151.101.3.52:443

cdn.crowdchange.ca

https

chrome.exe

22.7kB
1.4MB
185
1081
8.8.8.8:53

js.stripe.com

dns

chrome.exe

59 B
161 B
1
1

DNS Request

js.stripe.com

DNS Response

151.101.0.176

151.101.64.176

151.101.128.176

151.101.192.176
8.8.8.8:53

cdn.givechariot.com

dns

chrome.exe

65 B
171 B
1
1

DNS Request

cdn.givechariot.com

DNS Response

18.172.89.114

18.172.89.76

18.172.89.79

18.172.89.100
8.8.8.8:53

crowdchange-ca.imgix.net

dns

chrome.exe

70 B
179 B
1
1

DNS Request

crowdchange-ca.imgix.net

DNS Response

151.101.2.208

151.101.66.208

151.101.130.208

151.101.194.208
8.8.8.8:53

52.3.101.151.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

52.3.101.151.in-addr.arpa
8.8.8.8:53

31.249.124.192.in-addr.arpa

dns

73 B
113 B
1
1

DNS Request

31.249.124.192.in-addr.arpa
8.8.8.8:53

10.180.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

10.180.250.142.in-addr.arpa
8.8.8.8:53

35.200.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

35.200.250.142.in-addr.arpa
8.8.8.8:53

40.200.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

40.200.250.142.in-addr.arpa
8.8.8.8:53

176.0.101.151.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

176.0.101.151.in-addr.arpa
8.8.8.8:53

114.89.172.18.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

114.89.172.18.in-addr.arpa
8.8.8.8:53

208.2.101.151.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

208.2.101.151.in-addr.arpa
8.8.8.8:53

226.21.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

226.21.18.104.in-addr.arpa
8.8.8.8:53

platform.twitter.com

dns

chrome.exe

66 B
241 B
1
1

DNS Request

platform.twitter.com

DNS Response

93.184.220.66
8.8.8.8:53

66.220.184.93.in-addr.arpa

dns

72 B
143 B
1
1

DNS Request

66.220.184.93.in-addr.arpa
8.8.8.8:53

connect.facebook.net

dns

chrome.exe

66 B
114 B
1
1

DNS Request

connect.facebook.net

DNS Response

163.70.151.21
8.8.8.8:53

sessions.bugsnag.com

dns

chrome.exe

66 B
82 B
1
1

DNS Request

sessions.bugsnag.com

DNS Response

35.190.88.7
8.8.8.8:53

21.151.70.163.in-addr.arpa

dns

72 B
116 B
1
1

DNS Request

21.151.70.163.in-addr.arpa
163.70.151.21:443

connect.facebook.net

https

chrome.exe

4.0kB
9.3kB
8
13
163.70.151.21:443

connect.facebook.net

https

chrome.exe

4.5kB
97.8kB
44
84
8.8.8.8:53

ws-mt1.pusher.com

dns

chrome.exe

63 B
259 B
1
1

DNS Request

ws-mt1.pusher.com

DNS Response

34.232.238.221

34.226.23.254

3.235.210.167

54.88.194.95

52.5.38.178

54.243.190.192

3.213.107.173

52.55.5.17
35.190.88.7:443

sessions.bugsnag.com

https

chrome.exe

2.8kB
4.2kB
8
9
8.8.8.8:53

m.stripe.network

dns

chrome.exe

62 B
169 B
1
1

DNS Request

m.stripe.network

DNS Response

3.162.20.80

3.162.20.102

3.162.20.128

3.162.20.35
8.8.8.8:53

analytics.google.com

dns

chrome.exe

66 B
82 B
1
1

DNS Request

analytics.google.com

DNS Response

216.58.204.78
8.8.8.8:53

stats.g.doubleclick.net

dns

chrome.exe

69 B
133 B
1
1

DNS Request

stats.g.doubleclick.net

DNS Response

64.233.184.157

64.233.184.154

64.233.184.155

64.233.184.156
8.8.8.8:53

googleads.g.doubleclick.net

dns

chrome.exe

73 B
89 B
1
1

DNS Request

googleads.g.doubleclick.net

DNS Response

142.250.200.2
8.8.8.8:53

api.stripe.com

dns

chrome.exe

60 B
108 B
1
1

DNS Request

api.stripe.com

DNS Response

34.241.59.225

34.250.29.31

34.250.89.120
8.8.8.8:53

content-autofill.googleapis.com

dns

chrome.exe

77 B
285 B
1
1

DNS Request

content-autofill.googleapis.com

DNS Response

142.250.200.10

142.250.178.10

216.58.201.106

216.58.204.74

172.217.169.10

216.58.212.202

172.217.169.74

142.250.179.234

142.250.180.10

142.250.187.202

142.250.187.234

142.250.200.42

172.217.16.234
8.8.8.8:53

www.facebook.com

dns

chrome.exe

62 B
107 B
1
1

DNS Request

www.facebook.com

DNS Response

163.70.151.35
8.8.8.8:53

syndication.twitter.com

dns

chrome.exe

69 B
85 B
1
1

DNS Request

syndication.twitter.com

DNS Response

104.244.42.72
8.8.8.8:53

www.google.com

dns

chrome.exe

120 B
76 B
2
1

DNS Request

www.google.com

DNS Request

www.google.com

DNS Response

216.58.204.68
8.8.8.8:53

7.88.190.35.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

7.88.190.35.in-addr.arpa
8.8.8.8:53

221.238.232.34.in-addr.arpa

dns

73 B
129 B
1
1

DNS Request

221.238.232.34.in-addr.arpa
8.8.8.8:53

80.20.162.3.in-addr.arpa

dns

70 B
125 B
1
1

DNS Request

80.20.162.3.in-addr.arpa
8.8.8.8:53

78.204.58.216.in-addr.arpa

dns

72 B
171 B
1
1

DNS Request

78.204.58.216.in-addr.arpa
8.8.8.8:53

2.200.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

2.200.250.142.in-addr.arpa
8.8.8.8:53

157.184.233.64.in-addr.arpa

dns

73 B
107 B
1
1

DNS Request

157.184.233.64.in-addr.arpa
8.8.8.8:53

10.200.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

10.200.250.142.in-addr.arpa
8.8.8.8:53

225.59.241.34.in-addr.arpa

dns

72 B
114 B
1
1

DNS Request

225.59.241.34.in-addr.arpa
8.8.8.8:53

35.151.70.163.in-addr.arpa

dns

72 B
125 B
1
1

DNS Request

35.151.70.163.in-addr.arpa
8.8.8.8:53

72.42.244.104.in-addr.arpa

dns

72 B
72 B
1
1

DNS Request

72.42.244.104.in-addr.arpa
8.8.8.8:53

m.stripe.com

dns

chrome.exe

58 B
186 B
1
1

DNS Request

m.stripe.com

DNS Response

44.240.235.135

44.239.252.40

44.237.125.219

54.213.45.60

44.237.105.128

44.233.205.94

44.237.49.162

44.237.131.121
216.58.204.68:443

www.google.com

https

chrome.exe

3.9kB
7.6kB
9
10
8.8.8.8:53

r.stripe.com

dns

chrome.exe

58 B
106 B
1
1

DNS Request

r.stripe.com

DNS Response

54.186.23.98

54.187.119.242

54.187.159.182
8.8.8.8:53

135.235.240.44.in-addr.arpa

dns

73 B
137 B
1
1

DNS Request

135.235.240.44.in-addr.arpa
8.8.8.8:53

68.204.58.216.in-addr.arpa

dns

72 B
169 B
1
1

DNS Request

68.204.58.216.in-addr.arpa
8.8.8.8:53

98.23.186.54.in-addr.arpa

dns

71 B
111 B
1
1

DNS Request

98.23.186.54.in-addr.arpa
224.0.0.251:5353

chrome.exe

204 B
3
216.58.204.78:443

analytics.google.com

https

chrome.exe

5.3kB
8.0kB
14
18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
5ccba4a1f714e9ba8ab562aeebd81613

SHA1
d5b0f0305b7b9b7acf7abe4ebb6066809738e25d

SHA256
e74c80b26ceec70ba8c7b21e7bcc7c5a7993baa0b8a1c55846fba33d9299d636

SHA512
f88050d8228416762374d8763cce05659f2fbb1da2575a9087aa2407a7673d6b0e77c1f06a9ef8ff0b16d403f84037549108fcdcd42217d28c16b4f0954e5147

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
359bd65a1f8c7c5486f7230e6115f011

SHA1
2b41253c2f4e5b5f24e4274ea67a7c0ff33daa65

SHA256
3f8998ae0dfc253ae85d98202e2bfa69a17f4aa7d6a54654ca5a8d7655aa73f2

SHA512
c224d178b4dd84d7a9d065abea97888e55c04e5cc5bed10fe32b03356b1ee3f7549d76fe2abc9b481a7e303a31ea603dae95a2c78db5c2fcca54716b8770067f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
efce330c19ca1ebfe8dda181ec429235

SHA1
b3b700644178e8d59afca3d4c1f60b3cb543b0f1

SHA256
287a2c588c02854c8e1c0a8934012538184ceb90e0a2049f296478331969e709

SHA512
0753fcd72e722e13681fb2da6a7c8f18e0a075474451ceb72434befc6e186c7dae9cc5e6d937f6cc6cb34bf15d08c9342e19151e2b6e772d816d888151ca2ac3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
70fede9efc591a00d0224e4e7dbe6f07

SHA1
3208f701632c8e400cbdf12b9e3985c8d2d724fe

SHA256
eb4191369d8d63b293a126b67a96a41faaf36c554853e430481fe2fd5a92b6f6

SHA512
a54a3bfb57c954ddfa662b33d7ee29345a8a60306445141f38e781069eb011051f849ea59490280c60fad24fb48058f504ecfe6881d4754b448b31360aeb2f35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0a113afdb2d6f66471d6efc59a76d4cd

SHA1
442534400ee028e2958150b7b3cb8cf6233dcd1c

SHA256
ea6053e8869c11c7df1a6d9701c09810e109b79d878303bd9a7f2ad259cc9e0f

SHA512
9ec4b2eaf28bbcbacf517198d1d334f9c5b4e30e874eb464f0ca7ea99793adad61a8ce72c27639b2feb666c4011f83d5136a29f3a0beea3ee00ec516bd087709

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
d96b812a005b0526a80db8eae27d47b6

SHA1
13a2e1fcabdf80aa8f54fd64578a2ad2d258d147

SHA256
b135127e195b111ba10bc5b34fe9013cf15087020ba68a25e5c4f901eee216dd

SHA512
dfc7e1ecf5589711c38e7e652f477db01f35964af3c0ca6b84040304ac94cfdee78a6f2311dfd9711d1adf8607e24e537f92579d344d7e732d9340ecc148da6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request