Edit tour

Windows Analysis Report
https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfR

Overview

General Information

Sample URL:	https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJV
Analysis ID:	1645535
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1812,i,456294983529454022,16181888836083015467,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /ccm/collect?en=page_view&dl=https%3A%2F%2Frefinance.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=695489477.1742588953&dt=Quicken%20Loans%20-%20Talk%20to%20an%20Expert&auid=284078191.1742588953&navt=n&npa=0&gtm=45He53j1v9137104487za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102482433~102788824~102803279~102813109&tft=1742588953352&tfd=9253&apve=1 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://refinance.quickenloans.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 21 Mar 2025 20:29:09 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="92403324af3175e1"x-content-options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 21 Mar 2025 20:29:14 GMTContent-Type: text/html; charset=UTF-8Content-Length: 8672Connection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="92403345ad0e5017"x-content-options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 21 Mar 2025 20:29:15 GMTContent-Type: text/html; charset=UTF-8Content-Length: 7636Connection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="9240334b8c554233"x-content-options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 21 Mar 2025 20:29:18 GMTContent-Type: application/json; charset=utf-8Content-Length: 70Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *ETag: W/"46-ipg9rsCUK0P4SpXEE24G+u19uHc"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 21 Mar 2025 20:29:18 GMTContent-Type: application/json; charset=utf-8Content-Length: 60Connection: closevary: originaccess-control-expose-headers: WWW-Authenticate,Server-Authorizationcache-control: no-cache

Source: chromecache_102.2.dr	String found in binary or memory: http://deviceatlas.com
Source: chromecache_92.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_110.2.dr	String found in binary or memory: https://analytics.google.com/g/s/collect?dma=0&npa=0&gcd=13l3l3l3l1l1&gtm=45j91e53j1v9169491831z8913
Source: chromecache_86.2.dr, chromecache_89.2.dr	String found in binary or memory: https://api.pushnami.com
Source: chromecache_86.2.dr	String found in binary or memory: https://api.pushnami.com/api/push/subscribe
Source: chromecache_86.2.dr	String found in binary or memory: https://api.pushnami.com/api/push/unsubscribe
Source: chromecache_86.2.dr	String found in binary or memory: https://api.pushnami.com/api/push/waterfall/enrollment
Source: chromecache_86.2.dr	String found in binary or memory: https://api.pushnami.com/api/push/waterfall/enrollment?psid=
Source: chromecache_86.2.dr	String found in binary or memory: https://api.pushnami.com/scripts/v1/hub
Source: chromecache_103.2.dr	String found in binary or memory: https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7
Source: chromecache_86.2.dr	String found in binary or memory: https://api.pushnami.com/scripts/v1/pushnami-two-step-styles/5fa1b4cbe02a560012bcbdf7
Source: chromecache_86.2.dr	String found in binary or memory: https://api.pushnami.com/scripts/v1/pushnami-two-step/5fa1b4cbe02a560012bcbdf7
Source: chromecache_109.2.dr	String found in binary or memory: https://api.pushnami.com/scripts/v2/pushnami-sw/5fa1b4cbe02a560012bcbdf7
Source: chromecache_104.2.dr	String found in binary or memory: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.js
Source: chromecache_93.2.dr, chromecache_92.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_86.2.dr	String found in binary or memory: https://cdn.pushnami.com/css/opt-in/
Source: chromecache_86.2.dr	String found in binary or memory: https://cdn.pushnami.com/js/modules
Source: chromecache_86.2.dr	String found in binary or memory: https://cdn.pushnami.com/js/opt-in/
Source: chromecache_89.2.dr	String found in binary or memory: https://cdn.pushnami.com/js/workers/sw.355e010fef1d4bf4045b.bundle.js
Source: chromecache_97.2.dr	String found in binary or memory: https://content.itshome.com/itshome/check-square-regular.png
Source: chromecache_97.2.dr	String found in binary or memory: https://content.itshome.com/itshome/medal-solid.png
Source: chromecache_97.2.dr	String found in binary or memory: https://content.itshome.com/itshome/percent-solid.png
Source: chromecache_101.2.dr	String found in binary or memory: https://content.lowermybills.com/lre/LMBlogoV2-1.png);
Source: chromecache_97.2.dr	String found in binary or memory: https://content.lowermybills.com/lre/hud_logo.gif
Source: chromecache_101.2.dr	String found in binary or memory: https://content.lowermybills.com/msql/BBBIcon.png);
Source: chromecache_101.2.dr	String found in binary or memory: https://content.lowermybills.com/msql/moneyIcon.png);
Source: chromecache_103.2.dr	String found in binary or memory: https://content.lowermybills.com/wham/favicon.ico
Source: chromecache_86.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLD.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLDCOND.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLDCONDIT.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLDIT.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-COND.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-CONDIT.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-REGULAR.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-SEMIBOLD.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MYRIADPRO-SEMIBOLDIT.woff
Source: chromecache_114.2.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/492/MyriadPro-Light.woff
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXV0poK5.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXZ0poK5.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXd0poK5.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXh0pg.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXx0poK5.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_99.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_100.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/worksans/v19/QGY9z_wNahGAdqQ43Rh_ebrnlwyYfEPxPoGU3ms5pIfY.woff2)
Source: chromecache_100.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/worksans/v19/QGY9z_wNahGAdqQ43Rh_ebrnlwyYfEPxPoGU3ms5q4fYGyA.woff2)
Source: chromecache_100.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/worksans/v19/QGY9z_wNahGAdqQ43Rh_ebrnlwyYfEPxPoGU3ms5qofYGyA.woff2)
Source: chromecache_100.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_c6Dpp_k.woff2)
Source: chromecache_100.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_cqDpp_k.woff2)
Source: chromecache_100.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2)
Source: chromecache_86.2.dr	String found in binary or memory: https://github.com/zendesk/cross-storage/blob/master/dist/client.min.js
Source: chromecache_97.2.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_97.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.38.1/LICENSE
Source: chromecache_92.2.dr	String found in binary or memory: https://google.com
Source: chromecache_92.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_92.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_93.2.dr, chromecache_92.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_103.2.dr	String found in binary or memory: https://prod.mortgage.quickenloans.com
Source: chromecache_86.2.dr	String found in binary or memory: https://psp.pushnami.com/api/psp
Source: chromecache_103.2.dr	String found in binary or memory: https://qa.mortgage.quickenloans.com
Source: chromecache_89.2.dr	String found in binary or memory: https://rtpd.pushnami.com
Source: chromecache_103.2.dr	String found in binary or memory: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Source: chromecache_92.2.dr	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: chromecache_93.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_93.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_110.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&npa=0&gcd=13l3l3l3l1l1&tid=G-RXLL9Z7XBK&cid=1603
Source: chromecache_93.2.dr, chromecache_92.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_89.2.dr	String found in binary or memory: https://trc.pushnami.com
Source: chromecache_86.2.dr	String found in binary or memory: https://trc.pushnami.com/api/push/track
Source: chromecache_103.2.dr	String found in binary or memory: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Source: chromecache_92.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_92.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_92.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_93.2.dr, chromecache_92.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_103.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_93.2.dr, chromecache_92.2.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_93.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_93.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 142.250.65.228:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.251.133:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.36.162.171:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.33:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.201.76.131:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.12.43:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.219.104:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.33:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.124.46:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.80.73:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.57:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.158:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.18.206.181:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.164:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.30.245:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.12.43:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.236.187.166:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.11:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.233.158.31:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.233.158.31:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.111.155:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.157.171.6:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.38.183:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.236.187.166:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.128.21:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.31.245:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.231.86.123:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.34.21:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.34.21:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.34.21:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.34.21:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.220.97.68:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.228.124.28:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.38.132:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.157.171.6:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.31.245:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.122:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.169.130.185:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.2:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.233.158.27:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.233.158.25:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.4:49831 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir2672_938731538

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2672_938731538

Jump to behavior

Source: classification engine

Classification label: mal48.win@26/61@95/38

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1812,i,456294983529454022,16181888836083015467,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1812,i,456294983529454022,16181888836083015467,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257	0%	Avira URL Cloud	safe
https://qa.mortgage.quickenloans.com	0%	Avira URL Cloud	safe
https://alloptin.net/?utm_source=bayengage&utm_medium=campaign-email&utm_campaign=r34	0%	Avira URL Cloud	safe
https://prod.mortgage.quickenloans.com	0%	Avira URL Cloud	safe
https://content.lowermybills.com/msql/moneyIcon.png);	0%	Avira URL Cloud	safe
https://sgtm.quickenloans.com/_/service_worker/53k0/sw_iframe.html?origin=https%3A%2F%2Frefinance.quickenloans.com&1p=1	0%	Avira URL Cloud	safe
https://content.lowermybills.com/msql/BBBIcon.png);	0%	Avira URL Cloud	safe
https://content.lowermybills.com/wham/favicon.ico	0%	Avira URL Cloud	safe
https://content.itshome.com/itshome/percent-solid.png	0%	Avira URL Cloud	safe
https://www.npvnt7trk.com/4RQSJ/79C6G4/?sub2=GoldAllOptin127	100%	Avira URL Cloud	phishing
https://content.itshome.com/itshome/medal-solid.png	0%	Avira URL Cloud	safe
https://content.itshome.com/itshome/check-square-regular.png	0%	Avira URL Cloud	safe
https://trackpixel.lowermybills.com/ql-lre/pixel.js	0%	Avira URL Cloud	safe
https://content.lowermybills.com/lre/hud_logo.gif	0%	Avira URL Cloud	safe
https://www.imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245	0%	Avira URL Cloud	safe
https://trackpixel.lowermybills.com/ql-lre/pixel-d4065424c141a0f7623e.js	0%	Avira URL Cloud	safe
https://content.lowermybills.com/lre/LMBlogoV2-1.png);	0%	Avira URL Cloud	safe
https://sgtm.quickenloans.com/_/service_worker/53k0/sw.js?origin=https%3A%2F%2Frefinance.quickenloans.com	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
static.cloudflareinsights.com	104.16.80.73	true	false	high
cdn.pushnami.com	13.249.91.122	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.113.94	true	false	high
d20qwf0wrdtevy.cloudfront.net	108.138.128.21	true	false	unknown
stats.g.doubleclick.net	142.251.111.155	true	false	high
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	54.236.187.166	true	false	high
cm.g.doubleclick.net	142.251.41.2	true	false	high
www.imbahsj2.com	104.21.64.33	true	false	unknown
www.google.com	142.250.65.228	true	false	high
rocketmortgage.com.ssl.sc.omtrdc.net	63.140.38.183	true	false	high
alloptin.net	162.213.251.133	true	false	unknown
trackpixel.lowermybills.com	104.18.30.245	true	false	unknown
browser-intake-datadoghq.com	3.233.158.25	true	false	high
sgtm.quickenloans.com	216.239.38.21	true	false	unknown
www.npvnt7trk.com	34.36.162.171	true	false	unknown
l4-logs-http-replay-pub-s0-0da3e6651b0ebb8e.elb.us-east-1.amazonaws.com	3.233.158.27	true	false	high
fonts.cdnfonts.com	172.67.184.158	true	false	high
google.com	142.250.81.238	true	false	high
psp.pushnami.com	54.157.171.6	true	false	high
trc.pushnami.com	3.231.86.123	true	false	high
refinance.quickenloans.com	104.18.12.43	true	false	high
l4-logs-http-rum-pub-s0-7d264be627ade923.elb.us-east-1.amazonaws.com	3.233.158.31	true	false	high
mailgun.org	34.110.180.34	true	false	high
www.lmbahsj2.com	35.201.76.131	true	false	high
analytics-alv.google.com	216.239.36.181	true	false	high
cs-cdn.deviceatlas.com	3.18.206.181	true	false	high
e7808.dscg.akamaiedge.net	23.51.57.57	true	false	high
www.datadoghq-browser-agent.com	108.138.124.46	true	false	high
content.lowermybills.com	104.18.31.245	true	false	unknown
api.pushnami.com	18.164.124.33	true	false	high
widget.trustpilot.com	18.173.219.104	true	false	high
quicken.demdex.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
email.sender.quickenhome.cloud	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	high
aa.agkn.com	unknown	unknown	false	high
somni.rocketmortgage.com	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
rum-http-intake.logs.datadoghq.com	unknown	unknown	false	high
session-replay.browser-intake-datadoghq.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7acc05b12c7a39cdf29097414f1a90ee?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Aql-lre-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1742588955095	false		high
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	false		high
https://refinance.quickenloans.com/main.2f10b80eae1d23a58fd4.css	false		high
https://dpm.demdex.net/ibs:dpid=21&dpuuid=212530605193020320502	false		high
https://somni.rocketmortgage.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=20097835703070260193204516495823199936&ts=1742588955402	false		high
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1742588954225	false		high
https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po	false		unknown
https://www.lmbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257	false		high
https://refinance.quickenloans.com/main.2f10b80eae1d23a58fd4.js	false		high
https://api.pushnami.com/scripts/v2/pushnami-sw/5fa1b4cbe02a560012bcbdf7	false		high
https://content.lowermybills.com/wham/favicon.ico	false	Avira URL Cloud: safe	unknown
https://refinance.quickenloans.com/cdn-cgi/rum?	false		high
https://www.lmbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245	false		high
https://session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Aql-lre-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7acc05b12c7a39cdf29097414f1a90ee&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=2399bde4-4a5f-446d-9816-8aa992db9d64	false		high
https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js	false		high
https://psp.pushnami.com/api/psp	false		high
https://api.pushnami.com/scripts/v1/hub	false		high
https://www.imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257	false	Avira URL Cloud: safe	unknown
https://session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Aql-lre-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7acc05b12c7a39cdf29097414f1a90ee&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=30bae18a-e2f9-4ac4-a868-98c4495f50de	false		high
https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=19930254376209798833185227286828653064	false		high
https://refinance.quickenloans.com/service-worker.js	false		high
https://trc.pushnami.com/api/push/track	false		high
https://sgtm.quickenloans.com/_/service_worker/53k0/sw_iframe.html?origin=https%3A%2F%2Frefinance.quickenloans.com&1p=1	false	Avira URL Cloud: safe	unknown
https://fonts.cdnfonts.com/css/myriad-pro	false		high
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDTuYhsCgj5SBU8n1oWA1QU&google_cver=1?gdpr=0&gdpr_consent=	false		high
https://alloptin.net/?utm_source=bayengage&utm_medium=campaign-email&utm_campaign=r34	false	Avira URL Cloud: safe	unknown
https://cdn.pushnami.com/js/workers/sw.355e010fef1d4bf4045b.bundle.js	false		high
https://google.com/domainreliability/upload	false		high
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7acc05b12c7a39cdf29097414f1a90ee?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Aql-lre-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1742588983257	false		high
https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a8347021421544729a365288af5a0b06&pkey=5b353692f5d648f5b816178d254be245&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a8347021421544729a365288af5a0b06&utm_medium=affiliate&utm_source=JMG+Media&utm_content=	false		high
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MTk5MzAyNTQzNzYyMDk3OTg4MzMxODUyMjcyODY4Mjg2NTMwNjQ=&google_tc=	false		high
https://www.datadoghq-browser-agent.com/datadog-rum-v3.js	false		high
https://www.npvnt7trk.com/4RQSJ/79C6G4/?sub2=GoldAllOptin127	false	Avira URL Cloud: phishing	unknown
https://cs-cdn.deviceatlas.com/dacs.js	false		high
https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7	false		high
https://sgtm.quickenloans.com/_/service_worker/53k0/sw.js?origin=https%3A%2F%2Frefinance.quickenloans.com	false	Avira URL Cloud: safe	unknown
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1742588954225	false		high
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7acc05b12c7a39cdf29097414f1a90ee?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Aql-lre-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1742588953775	false		high
https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=JMG+Media&utm_content=	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7acc05b12c7a39cdf29097414f1a90ee?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Aql-lre-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1742588956044	false		high
https://trackpixel.lowermybills.com/ql-lre/pixel.js	false	Avira URL Cloud: safe	unknown
https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js	false		high
https://refinance.quickenloans.com/api/vertical/QL_LRE_LP?optimizelyVisitorId=&sourceId=affl_everflow_ql-lre_165_921&moid=322646	false		high
https://www.imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MTk5MzAyNTQzNzYyMDk3OTg4MzMxODUyMjcyODY4Mjg2NTMwNjQ=	false		high
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7acc05b12c7a39cdf29097414f1a90ee?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Aql-lre-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1742589013271	false		high
https://browser-intake-datadoghq.com/api/v2/logs?ddsource=browser&ddtags=sdk_version%3A5.35.1%2Capi%3Afetch%2Cenv%3Aprod%2Cservice%3Aql&dd-api-key=pub4d5c615be9e91858ed9e115fd855570c&dd-evp-origin-version=5.35.1&dd-evp-origin=browser&dd-request-id=df051c39-e0bc-49e2-be7a-6935eef39dfd	false		high
https://trackpixel.lowermybills.com/ql-lre/pixel-d4065424c141a0f7623e.js	false	Avira URL Cloud: safe	unknown
https://quicken.demdex.net/dest5.html?d_nsid=0	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_93.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLDCOND.woff	chromecache_114.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLDCONDIT.woff	chromecache_114.2.dr	false		high
https://api.pushnami.com/api/push/waterfall/enrollment	chromecache_86.2.dr	false		high
https://github.com/zloirock/core-js	chromecache_97.2.dr	false		high
https://qa.mortgage.quickenloans.com	chromecache_103.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_92.2.dr	false		high
https://www.youtube.com/iframe_api	chromecache_93.2.dr	false		high
https://prod.mortgage.quickenloans.com	chromecache_103.2.dr	false	Avira URL Cloud: safe	unknown
https://api.pushnami.com/api/push/subscribe	chromecache_86.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-SEMIBOLDIT.woff	chromecache_114.2.dr	false		high
https://analytics.google.com/g/s/collect?dma=0&npa=0&gcd=13l3l3l3l1l1&gtm=45j91e53j1v9169491831z8913	chromecache_110.2.dr	false		high
https://api.pushnami.com/api/push/unsubscribe	chromecache_86.2.dr	false		high
https://api.pushnami.com	chromecache_86.2.dr, chromecache_89.2.dr	false		high
https://cct.google/taggy/agent.js	chromecache_93.2.dr, chromecache_92.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-CONDIT.woff	chromecache_114.2.dr	false		high
https://api.pushnami.com/scripts/v1/pushnami-two-step/5fa1b4cbe02a560012bcbdf7	chromecache_86.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLDIT.woff	chromecache_114.2.dr	false		high
https://github.com/zloirock/core-js/blob/v3.38.1/LICENSE	chromecache_97.2.dr	false		high
https://content.lowermybills.com/msql/moneyIcon.png);	chromecache_101.2.dr	false	Avira URL Cloud: safe	unknown
https://fonts.cdnfonts.com/s/492/MYRIADPRO-COND.woff	chromecache_114.2.dr	false		high
https://api.pushnami.com/scripts/v1/pushnami-two-step-styles/5fa1b4cbe02a560012bcbdf7	chromecache_86.2.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_93.2.dr	false		high
https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.js	chromecache_104.2.dr	false		high
https://content.itshome.com/itshome/percent-solid.png	chromecache_97.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.pushnami.com/js/modules	chromecache_86.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-REGULAR.woff	chromecache_114.2.dr	false		high
https://rtpd.pushnami.com	chromecache_89.2.dr	false		high
https://content.lowermybills.com/msql/BBBIcon.png);	chromecache_101.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zendesk/cross-storage/blob/master/dist/client.min.js	chromecache_86.2.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&dma=0&npa=0&gcd=13l3l3l3l1l1&tid=G-RXLL9Z7XBK&cid=1603	chromecache_110.2.dr	false		high
https://cdn.pushnami.com/css/opt-in/	chromecache_86.2.dr	false		high
https://content.itshome.com/itshome/check-square-regular.png	chromecache_97.2.dr	false	Avira URL Cloud: safe	unknown
http://deviceatlas.com	chromecache_102.2.dr	false		high
https://content.itshome.com/itshome/medal-solid.png	chromecache_97.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.pushnami.com/js/opt-in/	chromecache_86.2.dr	false		high
https://content.lowermybills.com/lre/hud_logo.gif	chromecache_97.2.dr	false	Avira URL Cloud: safe	unknown
https://content.lowermybills.com/lre/LMBlogoV2-1.png);	chromecache_101.2.dr	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net	chromecache_92.2.dr	false		high
https://static.hotjar.com/c/hotjar-	chromecache_92.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-SEMIBOLD.woff	chromecache_114.2.dr	false		high
https://trc.pushnami.com	chromecache_89.2.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy	chromecache_86.2.dr	false		high
https://td.doubleclick.net	chromecache_93.2.dr, chromecache_92.2.dr	false		high
https://www.merchant-center-analytics.goog	chromecache_93.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MyriadPro-Light.woff	chromecache_114.2.dr	false		high
https://api.pushnami.com/api/push/waterfall/enrollment?psid=	chromecache_86.2.dr	false		high
https://google.com	chromecache_92.2.dr	false		high
https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLD.woff	chromecache_114.2.dr	false		high
https://adservice.google.com/pagead/regclk?	chromecache_92.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.110.180.34	mailgun.org	United States	15169	GOOGLEUS	false
104.18.31.245	content.lowermybills.com	United States	13335	CLOUDFLARENETUS	false
18.173.219.104	widget.trustpilot.com	United States	3	MIT-GATEWAYSUS	false
3.233.158.27	l4-logs-http-replay-pub-s0-0da3e6651b0ebb8e.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
3.233.158.25	browser-intake-datadoghq.com	United States	14618	AMAZON-AESUS	false
63.140.38.183	rocketmortgage.com.ssl.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
108.138.124.46	www.datadoghq-browser-agent.com	United States	16509	AMAZON-02US	false
35.169.130.185	unknown	United States	14618	AMAZON-AESUS	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
142.250.81.238	google.com	United States	15169	GOOGLEUS	false
104.18.30.245	trackpixel.lowermybills.com	United States	13335	CLOUDFLARENETUS	false
18.164.124.11	unknown	United States	3	MIT-GATEWAYSUS	false
162.213.251.133	alloptin.net	United States	22612	NAMECHEAP-NETUS	false
142.250.65.164	unknown	United States	15169	GOOGLEUS	false
3.233.158.31	l4-logs-http-rum-pub-s0-7d264be627ade923.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.251.41.2	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
108.138.128.21	d20qwf0wrdtevy.cloudfront.net	United States	16509	AMAZON-02US	false
54.157.171.6	psp.pushnami.com	United States	14618	AMAZON-AESUS	false
104.21.64.33	www.imbahsj2.com	United States	13335	CLOUDFLARENETUS	false
34.228.124.28	unknown	United States	14618	AMAZON-AESUS	false
216.239.34.21	unknown	United States	15169	GOOGLEUS	false
172.67.184.158	fonts.cdnfonts.com	United States	13335	CLOUDFLARENETUS	false
216.239.38.21	sgtm.quickenloans.com	United States	15169	GOOGLEUS	false
18.164.124.33	api.pushnami.com	United States	3	MIT-GATEWAYSUS	false
44.220.97.68	unknown	United States	14618	AMAZON-AESUS	false
35.201.76.131	www.lmbahsj2.com	United States	15169	GOOGLEUS	false
142.251.111.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
23.51.57.57	e7808.dscg.akamaiedge.net	United States	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
13.249.91.122	cdn.pushnami.com	United States	16509	AMAZON-02US	false
216.239.36.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
63.140.38.132	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
104.18.12.43	refinance.quickenloans.com	United States	13335	CLOUDFLARENETUS	false
54.236.187.166	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
3.18.206.181	cs-cdn.deviceatlas.com	United States	16509	AMAZON-02US	false
34.36.162.171	www.npvnt7trk.com	United States	2686	ATGS-MMD-ASUS	false
142.250.65.228	www.google.com	United States	15169	GOOGLEUS	false
3.231.86.123	trc.pushnami.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1645535
Start date and time:	2025-03-21 21:27:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@26/61@95/38
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.65.163, 142.251.40.110, 64.233.180.84, 142.251.35.174, 142.251.40.238, 142.250.80.78, 142.250.65.206, 208.89.73.19, 142.251.40.232, 142.251.40.138, 142.251.40.200, 142.250.72.99, 142.251.40.206, 142.250.65.238, 142.250.80.46, 142.251.41.14, 142.251.41.3, 34.104.35.123, 142.250.80.35, 142.250.80.110, 184.31.69.3, 172.202.163.200
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, edgedl.me.gvt1.com, www.googletagmanager.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://email.sender.quickenhome.cloud/c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	12540
Entropy (8bit):	5.38628943989475
Encrypted:	false
SSDEEP:	192:cmOb2JOb9TObY3pbHpbxqpblAbQbxDblnb3bx8blObebxRblNbdbxiblEbUbx/bm:cmhCb3tmPXa9QLeBP
MD5:	5BA4A3ED009300ADFEE10FFBCF0EC98D
SHA1:	00858650903C8DEACE5E0CB3266DC1F5C437E22A
SHA-256:	A7D9D066818D14071483FB738ADA07980E96F9F418B0314FBFE4D3102D589316
SHA-512:	FD4C45AFA95178D2238BED0C4A00155AD55CDB8D4224F05835B585EE45AB5BFF35D5853D4BA8AD4FBA02A59EA0C468C381414791832CD4B1FE3F4BD4F5E2BF71
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Work+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap"
Preview:	/* vietnamese /.@font-face {. font-family: 'Work Sans';. font-style: italic;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/worksans/v19/QGY9z_wNahGAdqQ43Rh_ebrnlwyYfEPxPoGU3ms5q4fYGyA.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext /.@font-face {. font-family: 'Work Sans';. font-style: italic;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/worksans/v19/QGY9z_wNahGAdqQ43Rh_ebrnlwyYfEPxPoGU3ms5qofYGyA.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Work Sans';. font-style: italic;. font-weight: 400;. font-display: swap;. sr

Source: https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=JMG+Media&utm_content=	HTTP Parser: No favicon
Source: https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=JMG+Media&utm_content=	HTTP Parser: No favicon
Source: https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=JMG+Media&utm_content=	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: email.sender.quickenhome.cloud to https://alloptin.net?utm_source=bayengage&utm_medium=campaign-email&utm_campaign=r34
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.npvnt7trk.com to https://www.imbahsj2.com/2grqg2g/964qf6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.imbahsj2.com to https://www.lmbahsj2.com/2grqg2g/964qf6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.lmbahsj2.com to https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a8347021421544729a365288af5a0b06&pkey=5b353692f5d648f5b816178d254be245&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a8347021421544729a365288af5a0b06&utm_medium=affiliate&utm_source=jmg+media&utm_content=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: email.sender.quickenhome.cloud to https://alloptin.net?utm_source=bayengage&utm_medium=campaign-email&utm_campaign=r34
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.npvnt7trk.com to https://www.imbahsj2.com/2grqg2g/964qf6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.imbahsj2.com to https://www.lmbahsj2.com/2grqg2g/964qf6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.lmbahsj2.com to https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=jmg+media&utm_content=

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_93.2.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Sk:function(){e=sb()},Md:function(){d()}}};var bc=wa(["data-gtm-yt-inspected-"]),MG=["www.youtube.com","www.youtube-nocookie.com"],NG,OG=!1; equals www.youtube.com (Youtube)
Source: chromecache_93.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=xD(a,c,e);Q(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return Q(122),!0;if(d&&f){for(var m=Cb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},AD=function(){var a=[],b=function(c){return gb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_93.2.dr	String found in binary or memory: if(!(f\|\|g\|\|k\|\|m.length\|\|n.length))return;var q={Wh:f,Uh:g,Vh:k,Di:m,Ei:n,qf:p,Rb:e},r=z.YT;if(r)return r.ready&&r.ready(d),e;var u=z.onYouTubeIframeAPIReady;z.onYouTubeIframeAPIReady=function(){u&&u();d()};E(function(){for(var v=A.getElementsByTagName("script"),t=v.length,w=0;w<t;w++){var x=v[w].getAttribute("src");if(XG(x,"iframe_api")\|\|XG(x,"player_api"))return e}for(var y=A.getElementsByTagName("iframe"),B=y.length,C=0;C<B;C++)if(!OG&&VG(y[C],q.qf))return tc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_92.2.dr	String found in binary or memory: return f}KG.K="internal.enableAutoEventOnTimer";var bc=wa(["data-gtm-yt-inspected-"]),MG=["www.youtube.com","www.youtube-nocookie.com"],NG,OG=!1; equals www.youtube.com (Youtube)
Source: chromecache_93.2.dr	String found in binary or memory: var ZF=function(a,b,c,d,e){var f=VC("fsl",c?"nv.mwt":"mwt",0),g;g=c?VC("fsl","nv.ids",[]):VC("fsl","ids",[]);if(!g.length)return!0;var k=$C(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!IB(k,KB(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: email.sender.quickenhome.cloud
Source: global traffic	DNS traffic detected: DNS query: alloptin.net
Source: global traffic	DNS traffic detected: DNS query: www.npvnt7trk.com
Source: global traffic	DNS traffic detected: DNS query: www.imbahsj2.com
Source: global traffic	DNS traffic detected: DNS query: www.lmbahsj2.com
Source: global traffic	DNS traffic detected: DNS query: refinance.quickenloans.com
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: api.pushnami.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: www.datadoghq-browser-agent.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: fonts.cdnfonts.com
Source: global traffic	DNS traffic detected: DNS query: cs-cdn.deviceatlas.com
Source: global traffic	DNS traffic detected: DNS query: trackpixel.lowermybills.com
Source: global traffic	DNS traffic detected: DNS query: rum-http-intake.logs.datadoghq.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: sgtm.quickenloans.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: psp.pushnami.com
Source: global traffic	DNS traffic detected: DNS query: quicken.demdex.net
Source: global traffic	DNS traffic detected: DNS query: somni.rocketmortgage.com
Source: global traffic	DNS traffic detected: DNS query: aa.agkn.com
Source: global traffic	DNS traffic detected: DNS query: content.lowermybills.com
Source: global traffic	DNS traffic detected: DNS query: trc.pushnami.com
Source: global traffic	DNS traffic detected: DNS query: cdn.pushnami.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: session-replay.browser-intake-datadoghq.com
Source: global traffic	DNS traffic detected: DNS query: browser-intake-datadoghq.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 21:28:59.600979090 CET	53	64411	1.1.1.1	192.168.2.4
Mar 21, 2025 21:28:59.702708006 CET	53	52244	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:00.441391945 CET	53	63970	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:03.103497982 CET	61962	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:03.104073048 CET	65425	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:03.200964928 CET	53	61962	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:03.202043056 CET	53	65425	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:05.120759964 CET	64007	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:05.120816946 CET	54354	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:05.259052992 CET	53	64007	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:05.260554075 CET	53	54354	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:05.701111078 CET	62548	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:05.701313019 CET	54416	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:05.809181929 CET	53	62548	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:05.888500929 CET	53	54416	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:06.616221905 CET	52965	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:06.617463112 CET	62040	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:06.761977911 CET	53	62040	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:06.815469027 CET	53	52965	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:07.241511106 CET	50640	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:07.241868973 CET	55649	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:07.366745949 CET	53	55649	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:07.389461994 CET	53	50640	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:08.063630104 CET	62958	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:08.064038038 CET	54871	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:08.210331917 CET	53	54871	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:08.302818060 CET	53	62958	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:08.740434885 CET	55697	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:08.740709066 CET	59262	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:08.852672100 CET	53	59262	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:08.852967024 CET	53	55697	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:12.549130917 CET	54096	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:12.549366951 CET	63617	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:12.550486088 CET	60201	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:12.550632000 CET	63624	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:12.647540092 CET	53	54096	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:12.648163080 CET	53	63624	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:12.648194075 CET	53	60201	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:12.648504972 CET	53	63617	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:13.246459007 CET	65403	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:13.246644974 CET	59127	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:13.252115011 CET	56184	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:13.252546072 CET	58806	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:13.344693899 CET	53	59127	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:13.346148014 CET	53	65403	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:13.349987984 CET	53	56184	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:13.351284981 CET	53	58806	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:13.351875067 CET	53	51290	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.219569921 CET	49589	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.219835043 CET	56150	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.220545053 CET	64212	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.220715046 CET	54342	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.221189022 CET	50270	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.221380949 CET	57566	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.317490101 CET	52733	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.317677975 CET	63160	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.318742990 CET	53	56976	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.319742918 CET	53	56150	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.319886923 CET	53	64212	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.320184946 CET	53	54342	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.321345091 CET	53	49589	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.321363926 CET	53	50270	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.322699070 CET	53	57566	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.340362072 CET	65423	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.340605021 CET	56787	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.420792103 CET	53	63160	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.426017046 CET	53	52733	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.443646908 CET	53	65423	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.443662882 CET	53	56787	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.550875902 CET	53	52264	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:14.763870955 CET	52280	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:14.764100075 CET	64426	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.214637041 CET	59538	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.214847088 CET	59655	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.314659119 CET	53	59655	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:15.314843893 CET	53	59538	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:15.374677896 CET	63579	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.374833107 CET	55594	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.479278088 CET	53	55594	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:15.490504980 CET	53	63579	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:15.668742895 CET	57137	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.668888092 CET	64346	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.767283916 CET	53	64346	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:15.768300056 CET	53	57137	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:15.775002003 CET	53764	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.775300026 CET	60010	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:15.877962112 CET	53	53764	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:15.878401041 CET	53	60010	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.035418034 CET	55724	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.035613060 CET	56877	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.036397934 CET	61706	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.036655903 CET	59497	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.135463953 CET	53	55724	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.135919094 CET	53	56877	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.137427092 CET	53	59497	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.137948036 CET	53	61706	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.300764084 CET	53801	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.300996065 CET	62508	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.397017002 CET	61359	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.397460938 CET	55224	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.399743080 CET	53	53801	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.401504993 CET	53	62508	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.409048080 CET	64221	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.409331083 CET	52544	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:16.508188963 CET	53	64221	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.512495041 CET	53	52544	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.525326967 CET	53	61359	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:16.541291952 CET	53	55224	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.058542013 CET	54992	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.058929920 CET	60355	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.085433960 CET	64056	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.085860014 CET	53793	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.141793966 CET	65279	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.141951084 CET	49651	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.157987118 CET	53	54992	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.160115957 CET	53	60355	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.189945936 CET	53	64056	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.191040993 CET	53	53793	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.240849972 CET	53	49651	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.241483927 CET	53	65279	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.329632998 CET	63764	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.329791069 CET	50429	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.430505991 CET	53	50429	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.431341887 CET	53	63764	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.490725040 CET	61745	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.491122007 CET	49523	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.505898952 CET	53	55758	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.547404051 CET	64965	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.547570944 CET	54670	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.589968920 CET	53	49523	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.589989901 CET	53	61745	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.644432068 CET	53	64965	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.645188093 CET	53	54670	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.659837961 CET	53319	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.660073042 CET	53698	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.736562014 CET	49493	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.736970901 CET	56496	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.757491112 CET	64015	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.757639885 CET	51394	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:17.759037971 CET	53	53319	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.769988060 CET	53	53698	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.835436106 CET	53	49493	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.836877108 CET	53	56496	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.861263037 CET	53	64015	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:17.897872925 CET	53	51394	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:18.080184937 CET	51850	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:18.080463886 CET	49164	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:18.112484932 CET	57723	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:18.112787008 CET	49768	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:18.153740883 CET	51306	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:18.154073954 CET	56582	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:18.181437969 CET	53	49164	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:18.181901932 CET	53	51850	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:18.214960098 CET	53	57723	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:18.214982986 CET	53	49768	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:18.255873919 CET	53	51306	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:18.255896091 CET	53	56582	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:36.349404097 CET	53	60552	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:44.402297974 CET	61390	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:44.402513027 CET	52451	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:44.504208088 CET	53	61390	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:44.547921896 CET	53	52451	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:44.917494059 CET	55135	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:44.917706966 CET	59445	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:29:45.027688980 CET	53	55135	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:45.027889967 CET	53	59445	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:58.916974068 CET	53	51687	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:59.252052069 CET	53	51033	1.1.1.1	192.168.2.4
Mar 21, 2025 21:29:59.766518116 CET	53	50098	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:02.056022882 CET	138	138	192.168.2.4	192.168.2.255
Mar 21, 2025 21:30:09.558105946 CET	63181	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:09.558410883 CET	56476	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:09.658746958 CET	53	56476	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:09.659418106 CET	53	63181	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:10.569541931 CET	62523	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:10.569751978 CET	58514	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:10.674127102 CET	53	58514	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:10.675029039 CET	53	62523	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:12.601603031 CET	55214	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:12.700284004 CET	53	55214	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:13.601074934 CET	55214	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:13.702397108 CET	53	55214	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:14.602664948 CET	55214	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:14.705750942 CET	53	55214	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:15.560550928 CET	53203	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:15.560767889 CET	50782	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:15.660207987 CET	53	53203	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:15.661216974 CET	53	50782	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:16.586558104 CET	52568	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:16.586815119 CET	49505	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:16.617742062 CET	55214	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:16.685729027 CET	53	49505	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:16.685755968 CET	53	52568	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:16.720330000 CET	53	55214	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:17.559988976 CET	58298	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:17.560434103 CET	54961	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:17.658977032 CET	53	58298	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:17.660579920 CET	53	54961	1.1.1.1	192.168.2.4
Mar 21, 2025 21:30:20.632123947 CET	55214	53	192.168.2.4	1.1.1.1
Mar 21, 2025 21:30:20.735377073 CET	53	55214	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 21, 2025 21:29:05.888583899 CET	192.168.2.4	1.1.1.1	c235	(Port unreachable)	Destination Unreachable
Mar 21, 2025 21:29:17.897945881 CET	192.168.2.4	1.1.1.1	c234	(Port unreachable)	Destination Unreachable
Mar 21, 2025 21:29:44.547990084 CET	192.168.2.4	1.1.1.1	c2a7	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2025 21:29:12.790823936 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 21, 2025 21:29:12.881237984 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 21 Mar 2025 19:49:48 GMT Expires: Fri, 21 Mar 2025 20:39:48 GMT Age: 2364 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 21, 2025 21:29:12.889292002 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 21, 2025 21:29:12.980072975 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 21 Mar 2025 19:40:24 GMT Expires: Fri, 21 Mar 2025 20:30:24 GMT Age: 2928 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:05 UTC	1050	OUT	GET /c/eJxkjsFuqzAQRb_G3j1kxhgzCy-eFOU3kDEDsYJtaoZU-fsqatpNV6M55-rqzs6iNbPuJLnWdmAUogV5cxCs9bgoayarYDA9toB2WRbUvUc1yOhAgVEaFIAGA01rhw5x0S0MfUuIolMH5Zlq83HGcKd8K4masJVzlpu7Me-H0P8FXAVc_baVnWNuMrHQ15PTeJSzBhL6Mvkn5dWvJKB_iURzPJPQl-DT7uOa_1HycXvbHyj0pepOVsclNZ-lMGXRqfRMPnsmakpd5cGl0lhpcS0a27__84yzEwBESiGGSfUYBIBkx5nH7yS7kKbxfR6-jq0ajFWSqw93P200xtn9Yfzc6dX8uxFAPhx8BQAA__8NE3po HTTP/1.1 Host: email.sender.quickenhome.cloud Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:05 UTC	373	IN	HTTP/1.1 302 Found Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: no-store Content-Length: 534 Content-Type: text/html Date: Fri, 21 Mar 2025 20:29:05 GMT Location: https://alloptin.net?utm_source=bayengage&utm_medium=campaign-email&utm_campaign=r34 X-Robots-Tag: noindex X-Xss-Protection: 1; mode=block Connection: close
2025-03-21 20:29:05 UTC	534	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta name="robots" content="noindex"><meta charset="utf-8"></head><body><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be re

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:06 UTC	726	OUT	GET /?utm_source=bayengage&utm_medium=campaign-email&utm_campaign=r34 HTTP/1.1 Host: alloptin.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:06 UTC	290	IN	HTTP/1.1 301 Moved Permanently keep-alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Fri, 21 Mar 2025 20:29:06 GMT server: LiteSpeed location: https://www.npvnt7trk.com/4RQSJ/79C6G4/?sub2=GoldAllOptin127 x-turbo-charged-by: LiteSpeed connection: close
2025-03-21 20:29:06 UTC	795	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!importan

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	42793
Entropy (8bit):	4.776596252310623
Encrypted:	false
SSDEEP:	384:6CV3qCcFfaGiFn/DgcFtEEnFgKMn4HZEQ:FqPFfaGiFLgcFtEEn6K9HZEQ
MD5:	61BFCFEE29210D1A587795412125DD77
SHA1:	73B7256C6634AFB458D6891818294C8E83C96DFC
SHA-256:	EA8185CD7AAB6EA637D0220BE92CEB841C1F3CBCDED8D42AF8F8115717883ABD
SHA-512:	56FB879007B9E43E327D5CB31D6EBDA0DE99F22E4F95574DC3D367F2B87F95B1671B5C68F3CB14FCEDA9240CB6B0EB76896A557A2E5408E82785C3AB3E07A34D
Malicious:	false
Reputation:	low
URL:	https://refinance.quickenloans.com/main.2f10b80eae1d23a58fd4.css
Preview:	/* OCP */..ocpmatch__main-container{. text-align: center;. background-color: #fff !important;. font-family: 'Rocket Sans' !important;.}..ocpmatch__main-container .header-ql_lre{. margin-bottom: 0px;. border-bottom: 0px;.}..ocpmatch__main-container .header_disclosure_container, .ocpmatch__main-container .header-ql_lre .current-date-container{. display: none;.}..ocpmatch__main-container .header-ql_lre .big_logo_icon{. text-align: center;.}..ocpmatch__main-container .disclaimer__container{. max-width: 660px;. font-size: 12px;.}..ocpmatch__main-container .disclaimer__container p{. font-size: 0.8rem;. line-height: 14px;. color: #767676;. text-align: left;.}..ocpmatch__main-container .disclaimerLogo{. text-align: center;.}. .ocpmatch__main-container .ocp-interlincx__container {. overflow-y: inherit;. height: auto;. border: 1px solid #8D8D8C;. border-radius:20px;. max-width: 660px;. margin: 0 auto;. }. .ocpmatch__main-container .headline,. .ocpmatch__main-c

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21803)
Category:	downloaded
Size (bytes):	21896
Entropy (8bit):	5.218518639327578
Encrypted:	false
SSDEEP:	384:cv6oZby61loUBRL0Q9/y9mImAEH+T6T11+4QUbyHZKqr:+xhy6RFhwQ1+DkW
MD5:	CFE6E4CEAFBEA9F6E6C1EDAD91770CE9
SHA1:	B73E476A3B1ACFBC92E38CBD045448627434F8DF
SHA-256:	145029BD46EF6268A3683431599D1CC5E9B0153C2C5BF840F931E78DA99EE2A6
SHA-512:	01F28D571BEFF5B0E0114662E4D0D72AB696C4FB580BE768365D98CC504EF6B3EADB5810205CCF9BA13E261E55FFDF851935C3AC3203360BD0420CF420F2BBDE
Malicious:	false
Reputation:	low
URL:	https://cs-cdn.deviceatlas.com/dacs.js
Preview:	/. Copyright 2024 DeviceAtlas Limited. All rights reserved.. * http://deviceatlas.com. */.var DeviceAtlas=function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}return n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)n.d(r,o,function(t){return e[t]}.bind(null,o));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.ca

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (24820)
Category:	downloaded
Size (bytes):	28440
Entropy (8bit):	5.295387874305289
Encrypted:	false
SSDEEP:	384:9nzyd2Y2TbNVAeuGvGsRB7ZZmZvZHZ/JsZeZYZOZWFO:9zyIYWMejQ6FO
MD5:	424511E980883273C65AF07FEAA92EBA
SHA1:	375F867B23B8844C56ABC1DC93C7A8836DC99A5E
SHA-256:	77690F18FCB8D16E15A55288CA02161096133A917DC800F56535029BBC12A3DB
SHA-512:	C4A6C8FEF11B0FEE72B9E17F5F3106B7ADC8C74D5629A1241F72ECBE7B13960BBD0BAE0CE2B5A4ADC6FF3BD8148639E11FA523DFA7655EF35762C049735041C3
Malicious:	false
Reputation:	low
URL:	https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=JMG+Media&utm_content=
Preview:	<!DOCTYPE html>. <html lang='en'>. <head>. <meta name='viewport' content='width=device-width, initial-scale=1.0, maximum-scale=1.0'>. <meta charset="UTF-8"/>. <title>Quicken Loans - Talk to an Expert</title>. <meta name="description" content="Whether you want to buy or refi, Quicken Loans can help you finance your home. Compare home loan options, apply online, and talk to an expert today."/>. <meta name="keywords" content=""/>. <meta name="robots" content="noindex, nofollow">. <link rel="shortcut icon" href="https://content.lowermybills.com/wham/favicon.ico" />. <link rel="manifest" href="/manifest.json">. <link rel="stylesheet" href="/main.2f10b80eae1d23a58fd4.css" media="all" />. <script type='text/javascript' src='//widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js' . async></script>. <script>. var allowDomain = document.location.protocol + "//" + document.domain + (document.location.port ? ':'

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	3501
Entropy (8bit):	5.383873370647921
Encrypted:	false
SSDEEP:	96:EI5cZUiKliCJ86U+QTEVWfeLwTauSEegdkZ5edOIC:EI5hiWNJ8kQTEVWfeUauRfdkZ5edO1
MD5:	147FD3B00C22BA9C939712E9213C24CA
SHA1:	3B48369B86FA0574F35379AACD1F42CC9C98A52B
SHA-256:	70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
SHA-512:	E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
Malicious:	false
Reputation:	low
URL:	https://sgtm.quickenloans.com/_/service_worker/53k0/sw_iframe.html?origin=https%3A%2F%2Frefinance.quickenloans.com&1p=1
Preview:	<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:07 UTC	701	OUT	GET /4RQSJ/79C6G4/?sub2=GoldAllOptin127 HTTP/1.1 Host: www.npvnt7trk.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:07 UTC	745	IN	HTTP/1.1 302 Found server: nginx date: Fri, 21 Mar 2025 20:29:07 GMT content-type: text/html; charset=utf-8 Content-Length: 128 accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model location: https://www.Imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245 set-cookie: uniqueClick_79C6G4=6703a4e0-2ffd-499c-a117-093b55ce5dba:1742588947; Path=/; Expires=Sun, 23 Mar 2025 02:29:07 GMT; Secure; SameSite=None set-cookie: transaction_id=5b353692f5d648f5b816178d254be245; Path=/; Expires=Thu, 19 Jun 2025 20:29:07 GMT; Secure; SameSite=None vary: Origin x-eflow-request-id: 53084dfb-b500-4c7a-ac7b-84dcaebc7124 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-21 20:29:07 UTC	128	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 49 6d 62 61 68 73 6a 32 2e 63 6f 6d 2f 32 47 52 51 47 32 47 2f 39 36 34 51 46 36 2f 3f 73 6f 75 72 63 65 5f 69 64 3d 39 26 61 6d 70 3b 73 75 62 31 3d 33 26 61 6d 70 3b 73 75 62 32 3d 35 62 33 35 33 36 39 32 66 35 64 36 34 38 66 35 62 38 31 36 31 37 38 64 32 35 34 62 65 32 34 35 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://www.Imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245">Found</a>.

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:07 UTC	738	OUT	GET /2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245 HTTP/1.1 Host: www.imbahsj2.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:08 UTC	1084	IN	HTTP/1.1 302 Found Date: Fri, 21 Mar 2025 20:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: https://www.lmbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=5b353692f5d648f5b816178d254be245 expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate pragma: no-cache Set-Cookie: PHPSESSID=c1a961985004e178271267668d88dd3c; path=/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6xICbLXRsSSr1CuwM1MqGMLpl43%2FFZBQjEZTYvcJC3JNUW4j9HBpVHBGdI%2F%2BXwG0J3WYjmG0hzMkmXchoaUvSjqdXio%2B00AGvP%2Blc%2FBJiWXa6xm9L7kj5Nn6z%2FQkCABzVT7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9240331bbaa26da2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105007&min_rtt=104368&rtt_var=22552&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1310&delivery_rate=35603&cwnd=219&unsent_bytes=0&cid=4604935b085316fe&ts=456&x=0"
2025-03-21 20:29:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:08 UTC	587	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BCMnRzgEIvtXOAQiA1s4BCMjczgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:08 UTC	1303	IN	HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 20:29:08 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-LSYbQCSdeEzpnkFN3aO5NQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-21 20:29:08 UTC	1303	IN	Data Raw: 31 32 32 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 61 6e 6b 20 6f 66 20 61 6d 65 72 69 63 61 20 62 72 61 6e 63 68 20 63 6c 6f 73 75 72 65 73 22 2c 22 63 79 62 65 72 70 75 6e 6b 20 32 30 37 37 20 74 75 72 66 20 77 61 72 73 20 61 72 63 61 64 65 20 67 61 6d 65 22 2c 22 73 6e 6f 77 20 77 68 69 74 65 20 64 69 73 6e 65 79 20 6d 6f 76 69 65 22 2c 22 6e 61 73 61 20 61 73 74 72 6f 6e 61 75 74 73 20 72 65 74 75 72 6e 20 73 70 61 63 65 78 22 2c 22 70 61 75 6c 20 73 6b 65 6e 65 73 20 62 61 73 65 62 61 6c 6c 20 63 61 72 64 20 61 75 63 74 69 6f 6e 22 2c 22 6e 76 69 64 69 61 20 67 70 75 73 22 2c 22 61 73 73 61 73 73 69 6e 20 63 72 65 65 64 20 73 68 61 64 6f 77 73 22 2c 22 73 75 64 69 6b 73 68 61 20 6b 6f 6e 61 6e 6b 69 20 64 69 73 61 70 70 65 61 72 61 6e 63 65 22 5d Data Ascii: 122c)]}'["",["bank of america branch closures","cyberpunk 2077 turf wars arcade game","snow white disney movie","nasa astronauts return spacex","paul skenes baseball card auction","nvidia gpus","assassin creed shadows","sudiksha konanki disappearance"]
2025-03-21 20:29:08 UTC	1303	IN	Data Raw: 4e 52 57 48 56 33 55 46 68 5a 4e 47 4e 33 57 6b 5a 54 4e 57 68 54 62 57 35 78 53 56 5a 78 57 54 4e 48 4e 30 35 7a 56 6a 6c 71 4d 46 42 79 5a 31 46 6c 53 45 74 75 64 7a 6c 4a 53 6d 5a 45 56 32 52 50 53 6b 46 33 56 6a 5a 54 63 55 6c 6c 55 47 6b 31 59 69 39 42 53 6d 5a 78 54 69 73 30 65 45 35 7a 64 6c 5a 30 52 48 59 35 4f 54 46 48 62 46 46 70 55 43 39 42 51 54 64 53 4e 56 70 4b 55 58 67 78 54 31 67 32 51 6c 52 35 59 6e 45 32 61 6d 34 7a 64 6a 46 32 61 46 68 55 63 7a 55 34 5a 6c 4e 32 56 6e 68 73 52 6d 64 55 4f 45 70 6c 56 6a 46 30 57 55 67 76 62 32 35 44 4e 6b 4a 6d 52 57 56 56 4b 32 4e 71 56 54 5a 34 63 6b 78 4e 57 6d 6c 7a 52 6d 31 44 63 31 52 32 57 55 46 74 64 30 35 31 56 30 52 46 63 54 56 4c 62 6b 31 5a 4f 48 68 78 57 54 46 71 61 32 6c 59 55 31 49 7a 53 Data Ascii: NRWHV3UFhZNGN3WkZTNWhTbW5xSVZxWTNHN05zVjlqMFByZ1FlSEtudzlJSmZEV2RPSkF3VjZTcUllUGk1Yi9BSmZxTis0eE5zdlZ0RHY5OTFHbFFpUC9BQTdSNVpKUXgxT1g2QlR5YnE2am4zdjF2aFhUczU4ZlN2VnhsRmdUOEplVjF0WUgvb25DNkJmRWVVK2NqVTZ4ckxNWmlzRm1Dc1R2WUFtd051V0RFcTVLbk1ZOHhxWTFqa2lYU1IzS
2025-03-21 20:29:08 UTC	1303	IN	Data Raw: 45 77 31 55 7a 5a 36 5a 46 51 78 4e 31 6c 6a 56 44 46 54 56 58 52 50 51 33 6f 79 64 48 6f 33 57 56 68 53 61 31 55 35 51 30 70 6d 54 53 39 44 53 32 68 6e 64 30 64 78 4e 46 42 59 59 6e 42 6f 55 47 35 73 56 31 64 45 63 48 4a 4c 4d 6a 4a 4a 4e 32 35 46 4e 30 70 36 51 31 6c 43 5a 33 56 6c 57 6a 42 4c 62 48 6c 77 57 6e 5a 4b 57 47 5a 73 65 6e 68 4e 55 31 52 32 56 6e 55 33 51 57 35 55 63 58 52 77 53 45 31 45 4d 48 67 72 65 6b 39 6b 4e 55 6c 75 4b 30 5a 71 53 6a 42 76 55 31 4a 6c 4e 58 56 42 55 31 52 69 62 6a 49 33 4e 44 68 4c 61 6a 42 52 54 58 70 4f 52 30 6c 35 54 6c 4e 50 56 30 5a 71 59 30 63 79 4c 31 63 72 52 31 5a 78 64 30 39 59 61 33 6f 7a 54 56 70 34 53 53 74 6f 61 6d 31 70 4e 47 46 6c 57 55 35 6b 56 6a 46 59 4e 6a 63 35 55 48 49 72 4d 6b 74 68 53 30 78 4e Data Ascii: Ew1UzZ6ZFQxN1ljVDFTVXRPQ3oydHo3WVhSa1U5Q0pmTS9DS2hnd0dxNFBYYnBoUG5sV1dEcHJLMjJJN25FN0p6Q1lCZ3VlWjBLbHlwWnZKWGZsenhNU1R2VnU3QW5UcXRwSE1EMHgrek9kNUluK0ZqSjBvU1JlNXVBU1RibjI3NDhLajBRTXpOR0l5TlNPV0ZqY0cyL1crR1Zxd09Ya3ozTVp4SStoam1pNGFlWU5kVjFYNjc5UHIrMkthS0xN
2025-03-21 20:29:08 UTC	751	IN	Data Raw: 4e 56 46 55 7a 54 32 70 76 4e 6b 6c 35 63 79 39 53 52 44 67 30 55 58 70 52 4e 55 39 71 59 30 4a 44 5a 32 39 4c 52 46 46 33 54 6b 64 6e 4f 46 42 48 61 6d 4e 73 53 48 6c 56 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 4c 79 39 42 51 55 4a 46 53 55 46 46 51 55 46 52 51 55 31 43 52 56 46 42 51 30 56 52 52 55 52 46 55 55 67 76 65 45 46 42 59 6b 46 42 52 55 46 42 5a 30 31 43 51 56 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 4a 52 57 55 4e 42 64 31 46 49 51 57 59 76 52 55 46 45 55 56 46 42 51 55 56 45 51 58 64 4a 51 30 4a 33 57 55 Data Ascii: NVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CRVFBQ0VRRURFUUgveEFBYkFBRUFBZ01CQVFBQUFBQUFBQUFBQUFBQUJRWUNBd1FIQWYvRUFEUVFBQUVEQXdJQ0J3WU
2025-03-21 20:29:08 UTC	1220	IN	Data Raw: 39 61 38 0d 0a 4d 33 6c 73 62 32 5a 55 4d 7a 56 50 55 57 5a 31 55 46 4e 76 4e 47 4a 4c 54 47 6b 35 56 57 46 4f 64 48 4a 6d 63 6c 4a 79 65 47 51 30 65 6c 4e 68 54 48 5a 58 5a 7a 68 56 56 55 46 76 51 6c 46 44 5a 30 5a 42 56 6b 64 54 64 47 51 35 4e 44 5a 61 61 55 6f 7a 5a 31 64 57 51 57 56 6c 54 30 35 73 65 55 5a 6d 61 30 67 72 62 7a 4d 34 64 32 46 76 5a 6d 5a 78 4d 6a 52 4d 4d 56 42 57 5a 32 78 6f 63 30 4d 31 4c 30 5a 56 65 56 67 33 56 6e 49 34 4f 55 39 6f 63 48 56 34 54 6d 63 30 4b 32 68 59 54 45 64 74 52 6d 51 77 51 30 6b 72 63 6e 4e 45 62 79 39 4a 56 44 55 33 52 44 42 4f 59 32 77 7a 53 33 46 73 64 32 56 53 54 32 67 72 53 6e 64 46 63 56 68 34 56 53 73 34 64 57 35 49 4d 30 78 77 56 32 63 34 59 31 56 42 62 30 4a 52 51 32 64 4c 52 48 68 30 65 44 46 6a 54 30 Data Ascii: 9a8M3lsb2ZUMzVPUWZ1UFNvNGJLTGk5VWFOdHJmclJyeGQ0elNhTHZXZzhVVUFvQlFDZ0ZBVkdTdGQ5NDZaaUozZ1dWQWVlT05seUZma0grbzM4d2FvZmZxMjRMMVBWZ2xoc0M1L0ZVeVg3VnI4OU9ocHV4Tmc0K2hYTEdtRmQwQ0krcnNEby9JVDU3RDBOY2wzS3Fsd2VST2grSndFcVh4VSs4dW5IM0xwV2c4Y1VBb0JRQ2dLRHh0eDFjT0
2025-03-21 20:29:08 UTC	1220	IN	Data Raw: 36 63 57 78 6b 53 7a 4e 77 62 45 6f 78 53 45 52 34 51 33 6b 30 52 6d 5a 4d 63 46 56 30 64 32 64 45 62 48 49 79 64 31 46 44 51 55 39 47 56 6e 4e 72 53 6d 52 71 55 45 35 52 54 6c 4d 35 56 48 70 35 4d 54 64 6f 56 45 52 74 61 6b 45 77 62 6b 38 72 63 6c 56 52 63 46 46 34 63 54 56 75 5a 6b 70 76 52 45 55 79 63 44 6c 76 51 58 4e 58 4f 55 39 56 53 6b 4e 46 51 6b 6c 56 54 6e 52 44 61 55 46 4f 64 30 46 4f 57 6e 64 43 65 56 52 72 4e 45 46 43 54 31 46 4b 55 32 52 33 4e 6e 68 4b 61 56 4e 4a 65 6c 64 73 61 45 56 73 64 33 56 31 4e 44 4e 4c 57 46 4e 43 4f 46 4a 32 4f 57 6c 33 56 54 5a 6e 55 69 74 76 62 46 64 44 56 47 31 6e 53 6e 5a 4c 4c 7a 4a 77 4c 7a 59 76 63 57 64 4e 63 55 46 56 51 6c 67 31 56 6e 4e 74 54 30 31 59 4d 55 78 55 59 57 4e 36 52 30 5a 77 59 54 46 46 57 6b Data Ascii: 6cWxkSzNwbEoxSER4Q3k0RmZMcFV0d2dEbHIyd1FDQU9GVnNrSmRqUE5RTlM5VHp5MTdoVERtakEwbk8rclVRcFF4cTVuZkpvREUycDlvQXNXOU9VSkNFQklVTnRDaUFOd0FOWndCeVRrNEFCT1FKU2R3NnhKaVNJeldsaEVsd3V1NDNLWFNCOFJ2OWl3VTZnUitvbFdDVG1nSnZLLzJwLzYvcWdNcUFVQlg1VnNtT01YMUxUYWN6R0ZwYTFFWk
2025-03-21 20:29:08 UTC	39	IN	Data Raw: 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: ","QUERY","QUERY","ENTITY","QUERY"]}]
2025-03-21 20:29:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:09 UTC	971	OUT	GET /?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a8347021421544729a365288af5a0b06&pkey=5b353692f5d648f5b816178d254be245&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a8347021421544729a365288af5a0b06&utm_medium=affiliate&utm_source=JMG+Media&utm_content= HTTP/1.1 Host: refinance.quickenloans.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:09 UTC	1303	IN	HTTP/1.1 403 Forbidden Date: Fri, 21 Mar 2025 20:29:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy: same-origin server-timing: chlray;desc="92403324af3175e1" x-content-options: nosniff
2025-03-21 20:29:09 UTC	954	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 70 46 70 73 53 33 75 4d 79 78 6b 4a 31 51 30 59 4a 69 68 6e 57 44 79 4f 56 2b 6d 58 36 47 65 43 32 4f 76 62 73 6c 49 68 63 53 38 4c 7a 36 4e 4f 57 54 30 41 4b 57 50 4e 43 51 45 51 56 67 4a 47 46 73 64 36 47 57 6d 69 4d 37 48 4b 69 5a 68 6b 41 36 56 2b 65 4a 70 65 66 66 4f 7a 33 4b 56 5a 76 43 48 78 36 6b 71 59 58 77 32 41 53 78 4f 7a 45 4d 33 53 69 6d 6b 34 53 65 56 7a 55 6e 6e 6a 5a 58 64 4d 51 67 4b 79 50 41 61 4c 78 30 6c 50 4f 6e 4a 2b 76 67 3d 3d 24 77 4f 52 31 61 61 2b 50 69 78 33 64 63 55 47 47 68 69 5a 6b 57 41 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: pFpsS3uMyxkJ1Q0YJihnWDyOV+mX6GeC2OvbslIhcS8Lz6NOWT0AKWPNCQEQVgJGFsd6GWmiM7HKiZhkA6V+eJpeffOz3KVZvCHx6kqYXw2ASxOzEM3Simk4SeVzUnnjZXdMQgKyPAaLx0lPOnJ+vg==$wOR1aa+Pix3dcUGGhiZkWA==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2025-03-21 20:29:09 UTC	1369	IN	Data Raw: 32 35 65 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 25e5<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2025-03-21 20:29:09 UTC	1369	IN	Data Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
2025-03-21 20:29:09 UTC	1369	IN	Data Raw: 3a 20 30 2c 63 54 70 6c 56 3a 20 35 2c 63 54 70 6c 42 3a 20 27 63 66 27 2c 63 4b 3a 20 22 22 2c 66 61 3a 20 22 5c 2f 3f 6d 6f 69 64 3d 33 32 32 36 34 36 26 73 6f 75 72 63 65 69 64 3d 61 66 66 6c 5f 65 76 65 72 66 6c 6f 77 5f 71 6c 2d 6c 72 65 5f 31 36 35 5f 39 32 31 26 70 6b 65 79 31 3d 39 32 31 26 70 6b 65 79 32 3d 33 26 70 6b 65 79 33 3d 61 38 33 34 37 30 32 31 34 32 31 35 34 34 37 32 39 61 33 36 35 32 38 38 61 66 35 61 30 62 30 36 26 70 6b 65 79 3d 35 62 33 35 33 36 39 32 66 35 64 36 34 38 66 35 62 38 31 36 31 37 38 64 32 35 34 62 65 32 34 35 26 73 69 64 3d 31 36 35 26 63 6d 70 69 64 3d 31 36 35 26 63 72 74 69 64 3d 26 6f 69 64 3d 31 36 35 26 61 66 66 69 64 3d 39 32 31 26 5f 65 66 5f 74 72 61 6e 73 61 63 74 69 6f 6e 5f 69 64 3d 61 38 33 34 37 30 32 31 Data Ascii: : 0,cTplV: 5,cTplB: 'cf',cK: "",fa: "\/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a8347021421544729a365288af5a0b06&pkey=5b353692f5d648f5b816178d254be245&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a8347021
2025-03-21 20:29:09 UTC	1369	IN	Data Raw: 48 45 71 72 36 51 55 63 6b 68 4a 4c 6c 66 52 72 6f 73 56 62 49 46 72 58 56 48 7a 49 39 38 56 73 48 7a 72 68 77 70 50 4a 34 54 55 4f 68 56 78 33 6b 4e 4d 43 53 5a 4e 32 70 61 4e 6c 37 72 55 73 34 35 77 77 46 67 78 55 42 54 53 52 39 7a 31 4c 7a 74 61 70 7a 4a 39 6f 5a 37 37 55 58 75 6b 50 36 68 77 56 4d 49 70 62 53 70 7a 37 59 42 31 72 6f 74 35 77 44 32 36 74 34 55 57 53 56 79 5a 78 41 75 4b 48 57 33 58 4b 5a 4b 50 48 30 38 76 4a 2e 73 35 46 35 38 45 4d 4d 4f 42 48 52 4a 73 44 44 4e 44 70 68 6e 73 34 6b 43 30 78 55 6d 4f 39 35 35 78 33 6a 75 70 71 4b 72 4c 77 6f 68 63 36 4a 74 5f 32 54 7a 71 33 57 59 34 56 30 42 51 79 45 70 53 55 54 68 4f 31 46 67 47 36 4a 66 41 6c 66 77 4f 55 6a 33 6f 61 4e 6a 76 71 78 39 47 76 5f 76 4a 78 68 6b 67 6b 72 51 75 39 71 73 7a Data Ascii: HEqr6QUckhJLlfRrosVbIFrXVHzI98VsHzrhwpPJ4TUOhVx3kNMCSZN2paNl7rUs45wwFgxUBTSR9z1LztapzJ9oZ77UXukP6hwVMIpbSpz7YB1rot5wD26t4UWSVyZxAuKHW3XKZKPH08vJ.s5F58EMMOBHRJsDDNDphns4kC0xUmO955x3jupqKrLwohc6Jt_2Tzq3WY4V0BQyEpSUThO1FgG6JfAlfwOUj3oaNjvqx9Gv_vJxhkgkrQu9qsz
2025-03-21 20:29:09 UTC	1369	IN	Data Raw: 37 74 32 31 59 5f 47 43 4b 36 52 46 73 4d 55 6e 4c 69 2e 6e 63 6c 6a 42 30 4a 6e 5a 57 6f 68 4c 41 47 57 6e 36 62 48 4b 41 57 63 61 56 6b 50 75 31 66 36 7a 70 70 35 74 4e 56 77 51 34 69 48 47 61 57 43 62 63 53 55 59 35 31 38 69 77 79 5f 6f 32 6a 42 4e 4c 72 38 77 68 4d 45 64 79 37 35 2e 74 56 4a 35 74 31 6a 70 77 4d 45 5a 65 37 38 78 37 54 66 41 6c 72 38 78 4f 52 48 52 44 6f 6a 72 47 78 42 51 6a 38 5a 48 4c 63 61 74 66 62 76 4c 41 45 56 6a 5f 75 43 54 57 7a 67 7a 31 2e 54 69 35 75 49 33 58 74 46 77 39 59 75 72 5f 38 30 38 64 74 66 77 6f 50 5a 4e 34 63 32 6c 4c 75 7a 36 52 2e 4e 6a 50 31 36 76 71 65 53 75 42 36 31 52 76 49 45 4e 6b 53 44 77 4b 47 4b 2e 71 5a 78 38 5a 72 32 37 6f 67 39 2e 43 4a 6b 78 58 44 49 42 72 59 78 4a 43 55 4a 62 76 33 5a 55 48 34 58 Data Ascii: 7t21Y_GCK6RFsMUnLi.ncljB0JnZWohLAGWn6bHKAWcaVkPu1f6zpp5tNVwQ4iHGaWCbcSUY518iwy_o2jBNLr8whMEdy75.tVJ5t1jpwMEZe78x7TfAlr8xORHRDojrGxBQj8ZHLcatfbvLAEVj_uCTWzgz1.Ti5uI3XtFw9Yur_808dtfwoPZN4c2lLuz6R.NjP16vqeSuB61RvIENkSDwKGK.qZx8Zr27og9.CJkxXDIBrYxJCUJbv3ZUH4X
2025-03-21 20:29:09 UTC	1369	IN	Data Raw: 67 2e 37 6b 54 33 6a 4f 5a 41 59 63 4b 61 75 70 6d 78 72 69 4b 35 35 48 59 58 44 71 61 6d 33 7a 72 58 37 54 30 30 33 58 64 59 7a 72 4d 56 4b 34 33 38 31 61 47 56 4a 48 50 5a 59 62 76 64 79 4c 31 59 67 4a 55 43 6f 41 57 44 52 47 4d 35 42 59 77 4c 34 37 56 79 54 78 6a 7a 31 4b 6e 39 70 6a 78 6a 78 42 37 6a 63 47 42 35 38 54 36 64 76 6e 4e 55 75 6f 52 75 7a 64 57 39 50 32 36 75 73 4d 77 6b 4c 34 56 56 4f 68 4a 6f 52 71 32 4d 52 5a 75 59 6d 42 73 36 54 45 36 74 54 59 54 30 50 45 49 61 72 45 75 4b 2e 64 6a 53 73 47 34 32 68 56 48 44 51 54 61 33 78 44 33 61 6f 43 4a 49 41 73 4f 6b 66 48 57 70 4d 30 33 61 71 37 34 53 46 4c 72 4f 59 78 6c 62 53 57 6d 77 52 59 6e 35 5f 33 63 46 69 30 4d 5f 2e 55 73 37 72 66 7a 78 46 63 58 6b 54 58 30 68 4d 61 77 71 65 4e 54 75 63 Data Ascii: g.7kT3jOZAYcKaupmxriK55HYXDqam3zrX7T003XdYzrMVK4381aGVJHPZYbvdyL1YgJUCoAWDRGM5BYwL47VyTxjz1Kn9pjxjxB7jcGB58T6dvnNUuoRuzdW9P26usMwkL4VVOhJoRq2MRZuYmBs6TE6tTYT0PEIarEuK.djSsG42hVHDQTa3xD3aoCJIAsOkfHWpM03aq74SFLrOYxlbSWmwRYn5_3cFi0M_.Us7rfzxFcXkTX0hMawqeNTuc
2025-03-21 20:29:09 UTC	1369	IN	Data Raw: 20 26 26 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 23 27 29 20 21 3d 3d 20 2d 31 20 3f 20 27 23 27 20 3a 20 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 63 4f 67 55 51 75 65 72 79 20 3d 20 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 20 3d 3d 3d 20 27 27 20 26 26 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 73 6c 69 63 65 28 30 2c 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 6c 65 6e 67 74 68 20 2d 20 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 63 4f 67 55 48 61 73 68 2e 6c 65 6e 67 74 68 29 2e 69 6e 64 65 78 4f 66 28 27 3f 27 29 20 21 3d 3d 20 2d 31 20 3f 20 27 3f 27 20 3a 20 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 69 66 20 28 77 69 6e 64 6f 77 2e 68 Data Ascii: && location.href.indexOf('#') !== -1 ? '#' : location.hash;window._cf_chl_opt.cOgUQuery = location.search === '' && location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;if (window.h
2025-03-21 20:29:09 UTC	126	IN	Data Raw: 65 2c 22 63 66 43 61 63 68 65 53 74 61 74 75 73 22 3a 74 72 75 65 7d 7d 2c 22 74 6f 6b 65 6e 22 3a 22 61 32 34 35 38 36 33 32 62 64 37 33 34 63 63 39 39 66 31 64 34 63 63 61 30 31 31 65 61 30 62 36 22 2c 22 62 22 3a 31 7d 27 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: e,"cfCacheStatus":true}},"token":"a2458632bd734cc99f1d4cca011ea0b6","b":1}' crossorigin="anonymous"></script></body></html>
2025-03-21 20:29:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:09 UTC	885	OUT	GET /4RQSJ/79C6G4/?sub2=GoldAllOptin127 HTTP/1.1 Host: www.npvnt7trk.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: uniqueClick_79C6G4=6703a4e0-2ffd-499c-a117-093b55ce5dba:1742588947; transaction_id=5b353692f5d648f5b816178d254be245
2025-03-21 20:29:10 UTC	628	IN	HTTP/1.1 302 Found server: nginx date: Fri, 21 Mar 2025 20:29:10 GMT content-type: text/html; charset=utf-8 Content-Length: 128 accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model location: https://www.Imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257 set-cookie: transaction_id=5b353692f5d648f5b816178d254be245\|d7c07f37a6394a2bbae67846e1874257; Path=/; Expires=Thu, 19 Jun 2025 20:29:10 GMT; Secure; SameSite=None vary: Origin x-eflow-request-id: 1a7f76bb-fe82-460b-8952-457492733f91 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-21 20:29:10 UTC	128	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 49 6d 62 61 68 73 6a 32 2e 63 6f 6d 2f 32 47 52 51 47 32 47 2f 39 36 34 51 46 36 2f 3f 73 6f 75 72 63 65 5f 69 64 3d 39 26 61 6d 70 3b 73 75 62 31 3d 33 26 61 6d 70 3b 73 75 62 32 3d 64 37 63 30 37 66 33 37 61 36 33 39 34 61 32 62 62 61 65 36 37 38 34 36 65 31 38 37 34 32 35 37 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://www.Imbahsj2.com/2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257">Found</a>.

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:11 UTC	922	OUT	GET /2GRQG2G/964QF6/?source_id=9&sub1=3&sub2=d7c07f37a6394a2bbae67846e1874257 HTTP/1.1 Host: www.lmbahsj2.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: uniqueClick_964QF6=de152d8d-1f7d-49c4-b8a6-1894be7e9865:1742588948; transaction_id=a8347021421544729a365288af5a0b06
2025-03-21 20:29:11 UTC	861	IN	HTTP/1.1 302 Found server: nginx date: Fri, 21 Mar 2025 20:29:11 GMT content-type: text/html; charset=utf-8 Content-Length: 409 accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model location: https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=JMG+Media&utm_content= set-cookie: transaction_id=a8347021421544729a365288af5a0b06\|a0887d33513a409095fef18c0840aaf3; Path=/; Expires=Thu, 19 Jun 2025 20:29:11 GMT; Secure; SameSite=None vary: Origin x-eflow-request-id: bf879b0c-b09a-4f38-906d-21e1ed1bc44c Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-21 20:29:11 UTC	359	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 66 69 6e 61 6e 63 65 2e 71 75 69 63 6b 65 6e 6c 6f 61 6e 73 2e 63 6f 6d 2f 3f 6d 6f 69 64 3d 33 32 32 36 34 36 26 61 6d 70 3b 73 6f 75 72 63 65 69 64 3d 61 66 66 6c 5f 65 76 65 72 66 6c 6f 77 5f 71 6c 2d 6c 72 65 5f 31 36 35 5f 39 32 31 26 61 6d 70 3b 70 6b 65 79 31 3d 39 32 31 26 61 6d 70 3b 70 6b 65 79 32 3d 33 26 61 6d 70 3b 70 6b 65 79 33 3d 61 30 38 38 37 64 33 33 35 31 33 61 34 30 39 30 39 35 66 65 66 31 38 63 30 38 34 30 61 61 66 33 26 61 6d 70 3b 70 6b 65 79 3d 64 37 63 30 37 66 33 37 61 36 33 39 34 61 32 62 62 61 65 36 37 38 34 36 65 31 38 37 34 32 35 37 26 61 6d 70 3b 73 69 64 3d 31 36 35 26 61 6d 70 3b 63 6d 70 69 64 3d 31 36 35 26 61 6d 70 3b 63 72 74 69 64 3d 26 61 6d 70 3b 6f 69 64 3d Data Ascii: <a href="https://refinance.quickenloans.com/?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=
2025-03-21 20:29:11 UTC	50	IN	Data Raw: 74 6d 5f 73 6f 75 72 63 65 3d 4a 4d 47 2b 4d 65 64 69 61 26 61 6d 70 3b 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: tm_source=JMG+Media&utm_content=">Found</a>.

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:11 UTC	1429	OUT	GET /?moid=322646&sourceid=affl_everflow_ql-lre_165_921&pkey1=921&pkey2=3&pkey3=a0887d33513a409095fef18c0840aaf3&pkey=d7c07f37a6394a2bbae67846e1874257&sid=165&cmpid=165&crtid=&oid=165&affid=921&_ef_transaction_id=a0887d33513a409095fef18c0840aaf3&utm_medium=affiliate&utm_source=JMG+Media&utm_content= HTTP/1.1 Host: refinance.quickenloans.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "134.0.6998.36" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=b50atuKg7IfypPtBtfyfKPNOc6TeZ_xV0E5ZPPl2WC8-1742588949-1.0.1.1-yPXlY4a_CqVqIKvwZAWsbvE3Bph4rbl_4eqqWLRJ9DlE6nyHODQGgHz8IBf1_RjGzumSs9aclYF8inLs0fFp9yPSJgYDMgpHQ4pawWv4CD8
2025-03-21 20:29:12 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 20:29:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 92403333bd537cea-EWR CF-Cache-Status: DYNAMIC Cache-Control: private Set-Cookie: _lre_new=true; path=/; Expires='Fri Mar 28 2025 20:29:11 GMT+0000 (Coordinated Universal Time)' Strict-Transport-Security: max-age=2592000 _lre_new: true expect-ct: max-age=0 origin-agent-cluster: ?1 referrer-policy: no-referrer x-dns-prefetch-control: off x-download-options: noopen x-permitted-cross-domain-policies: none Server-Timing: cfCacheStatus;desc="DYNAMIC" Content-Security-Policy: frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: cloudflare
2025-03-21 20:29:12 UTC	514	IN	Data Raw: 63 63 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 27 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 76 69 65 77 70 6f 72 74 27 20 63 6f 6e 74 65 6e 74 3d 27 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 27 3e 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 51 75 69 63 6b 65 6e 20 4c 6f 61 6e 73 20 2d 20 54 61 6c 6b 20 74 6f 20 61 6e 20 45 78 70 65 72 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 Data Ascii: cc5<!DOCTYPE html> <html lang='en'> <head> <meta name='viewport' content='width=device-width, initial-scale=1.0, maximum-scale=1.0'> <meta charset="UTF-8"/> <title>Quicken Loans - Talk to an Expert</title> <meta name="descr
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 6c 6f 77 22 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 74 65 6e 74 2e 6c 6f 77 65 72 6d 79 62 69 6c 6c 73 2e 63 6f 6d 2f 77 68 61 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 68 72 65 66 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 6f 6e 22 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 6d 61 69 6e 2e 32 66 31 30 62 38 30 65 61 65 31 64 32 33 61 35 38 66 64 34 2e 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f Data Ascii: low"> <link rel="shortcut icon" href="https://content.lowermybills.com/wham/favicon.ico" /> <link rel="manifest" href="/manifest.json"> <link rel="stylesheet" href="/main.2f10b80eae1d23a58fd4.css" media="all" /> <script type='text/
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 63 69 6e 67 53 61 6d 70 6c 65 52 61 74 65 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 63 6b 52 65 73 6f 75 72 63 65 73 3a 20 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 63 6b 4c 6f 6e 67 54 61 73 6b 73 3a 20 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 63 6b 49 6e 74 65 72 61 63 74 69 6f 6e 73 3a 20 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 63 6b 46 72 75 73 74 72 61 74 69 6f 6e 73 3a 20 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 6c 6f 77 65 64 54 72 61 63 69 6e 67 Data Ascii: 0, tracingSampleRate: 100, trackResources: true, trackLongTasks: true, trackInteractions: true, trackFrustrations: true, allowedTracing
2025-03-21 20:29:12 UTC	24	IN	Data Raw: 70 73 3a 2f 2f 61 73 73 65 74 73 2e 61 64 6f 62 65 64 74 6d 2e 63 0d 0a Data Ascii: ps://assets.adobedtm.c
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 36 32 35 33 0d 0a 6f 6d 2f 62 31 34 36 33 36 62 31 30 38 38 38 2f 61 33 65 63 37 65 66 31 66 33 36 36 2f 6c 61 75 6e 63 68 2d 30 39 39 39 38 32 61 37 34 36 63 63 2e 6d 69 6e 2e 6a 73 22 2c 22 64 72 6f 70 64 6f 77 6e 73 22 3a 7b 22 6f 72 64 65 72 65 64 44 72 6f 70 64 6f 77 6e 73 22 3a 7b 22 61 67 65 52 61 6e 67 65 22 3a 5b 7b 22 76 61 6c 75 65 22 3a 22 22 2c 22 74 65 78 74 22 3a 22 53 65 6c 65 63 74 20 4f 6e 65 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 32 30 22 2c 22 74 65 78 74 22 3a 22 31 38 2d 32 35 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 33 30 22 2c 22 74 65 78 74 22 3a 22 32 36 2d 33 35 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 34 30 22 2c 22 74 65 78 74 22 3a 22 33 36 2d 34 35 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 35 30 22 2c 22 74 65 78 74 22 3a 22 34 36 Data Ascii: 6253om/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js","dropdowns":{"orderedDropdowns":{"ageRange":[{"value":"","text":"Select One"},{"value":"20","text":"18-25"},{"value":"30","text":"26-35"},{"value":"40","text":"36-45"},{"value":"50","text":"46
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 74 65 78 74 22 3a 22 43 72 65 64 69 74 20 43 61 72 64 20 44 65 62 74 20 43 6f 6e 73 6f 6c 69 64 61 74 69 6f 6e 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 48 4f 4d 45 5f 49 4d 50 52 4f 56 45 4d 45 4e 54 22 2c 22 74 65 78 74 22 3a 22 48 6f 6d 65 20 49 6d 70 72 6f 76 65 6d 65 6e 74 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 4c 41 52 47 45 5f 50 55 52 43 48 41 53 45 53 22 2c 22 74 65 78 74 22 3a 22 4c 61 72 67 65 20 50 75 72 63 68 61 73 65 73 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 4f 54 48 45 52 5f 44 45 42 54 5f 43 4f 4e 53 4c 44 22 2c 22 74 65 78 74 22 3a 22 4f 74 68 65 72 20 44 65 62 74 20 43 6f 6e 73 6f 6c 69 64 61 74 69 6f 6e 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 42 55 53 49 4e 45 53 53 22 2c 22 74 65 78 74 22 3a 22 42 75 73 69 6e 65 73 73 22 7d 2c 7b 22 76 61 Data Ascii: text":"Credit Card Debt Consolidation"},{"value":"HOME_IMPROVEMENT","text":"Home Improvement"},{"value":"LARGE_PURCHASES","text":"Large Purchases"},{"value":"OTHER_DEBT_CONSLD","text":"Other Debt Consolidation"},{"value":"BUSINESS","text":"Business"},{"va
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 22 76 61 6c 75 65 22 3a 22 41 72 6b 61 6e 73 61 73 22 2c 22 74 65 78 74 22 3a 22 41 72 6b 61 6e 73 61 73 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 41 6d 65 72 69 63 61 6e 20 53 61 6d 6f 61 22 2c 22 74 65 78 74 22 3a 22 41 6d 65 72 69 63 61 6e 20 53 61 6d 6f 61 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 2c 22 74 65 78 74 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 43 6f 6c 6f 72 61 64 6f 22 2c 22 74 65 78 74 22 3a 22 43 6f 6c 6f 72 61 64 6f 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 43 6f 6e 6e 65 63 74 69 63 75 74 22 2c 22 74 65 78 74 22 3a 22 43 6f 6e 6e 65 63 74 69 63 75 74 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 74 65 78 74 22 3a Data Ascii: "value":"Arkansas","text":"Arkansas"},{"value":"American Samoa","text":"American Samoa"},{"value":"California","text":"California"},{"value":"Colorado","text":"Colorado"},{"value":"Connecticut","text":"Connecticut"},{"value":"District of Columbia","text":
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 74 68 20 44 61 6b 6f 74 61 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 4f 68 69 6f 22 2c 22 74 65 78 74 22 3a 22 4f 68 69 6f 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 4f 6b 6c 61 68 6f 6d 61 22 2c 22 74 65 78 74 22 3a 22 4f 6b 6c 61 68 6f 6d 61 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 4f 72 65 67 6f 6e 22 2c 22 74 65 78 74 22 3a 22 4f 72 65 67 6f 6e 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 50 65 6e 6e 73 79 6c 76 61 6e 69 61 22 2c 22 74 65 78 74 22 3a 22 50 65 6e 6e 73 79 6c 76 61 6e 69 61 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 50 75 65 72 74 6f 20 52 69 63 6f 22 2c 22 74 65 78 74 22 3a 22 50 75 65 72 74 6f 20 52 69 63 6f 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 52 68 6f 64 65 20 49 73 6c 61 6e 64 22 2c 22 74 65 78 74 22 3a 22 52 68 6f 64 65 20 49 73 6c 61 6e 64 22 7d Data Ascii: th Dakota"},{"value":"Ohio","text":"Ohio"},{"value":"Oklahoma","text":"Oklahoma"},{"value":"Oregon","text":"Oregon"},{"value":"Pennsylvania","text":"Pennsylvania"},{"value":"Puerto Rico","text":"Puerto Rico"},{"value":"Rhode Island","text":"Rhode Island"}
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 75 65 22 3a 22 51 55 49 43 4b 45 4e 5f 4c 4f 41 4e 53 22 2c 22 74 65 78 74 22 3a 22 51 75 69 63 6b 65 6e 20 4c 6f 61 6e 73 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 55 53 5f 42 41 4e 4b 22 2c 22 74 65 78 74 22 3a 22 55 53 20 42 61 6e 6b 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 55 53 41 41 5f 46 45 44 45 52 41 4c 5f 53 41 56 49 4e 47 53 5f 42 41 4e 4b 22 2c 22 74 65 78 74 22 3a 22 55 73 61 61 20 46 65 64 65 72 61 6c 20 53 61 76 69 6e 67 73 20 42 61 6e 6b 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 56 45 54 45 52 41 4e 53 5f 55 4e 49 54 45 44 22 2c 22 74 65 78 74 22 3a 22 56 65 74 65 72 61 6e 73 20 55 6e 69 74 65 64 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 57 45 4c 4c 53 5f 46 41 52 47 4f 22 2c 22 74 65 78 74 22 3a 22 57 65 6c 6c 73 20 46 61 72 67 6f 22 7d 2c 7b 22 76 Data Ascii: ue":"QUICKEN_LOANS","text":"Quicken Loans"},{"value":"US_BANK","text":"US Bank"},{"value":"USAA_FEDERAL_SAVINGS_BANK","text":"Usaa Federal Savings Bank"},{"value":"VETERANS_UNITED","text":"Veterans United"},{"value":"WELLS_FARGO","text":"Wells Fargo"},{"v
2025-03-21 20:29:12 UTC	1369	IN	Data Raw: 30 35 30 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 24 32 2c 31 30 31 2d 24 32 2c 32 30 30 22 2c 22 74 65 78 74 22 3a 22 32 31 35 30 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 24 32 2c 32 30 31 2d 24 32 2c 33 30 30 22 2c 22 74 65 78 74 22 3a 22 32 32 35 30 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 24 32 2c 33 30 31 2d 24 32 2c 34 30 30 22 2c 22 74 65 78 74 22 3a 22 32 33 35 30 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 24 32 2c 34 30 31 2d 24 32 2c 35 30 30 22 2c 22 74 65 78 74 22 3a 22 32 34 35 30 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 24 32 2c 35 30 31 2d 24 32 2c 36 30 30 22 2c 22 74 65 78 74 22 3a 22 32 35 35 30 22 7d 2c 7b 22 76 61 6c 75 65 22 3a 22 24 32 2c 36 30 31 2d 24 32 2c 37 30 30 22 2c 22 74 65 78 74 22 3a 22 32 36 35 30 22 7d 2c 7b 22 76 61 6c 75 65 22 3a Data Ascii: 050"},{"value":"$2,101-$2,200","text":"2150"},{"value":"$2,201-$2,300","text":"2250"},{"value":"$2,301-$2,400","text":"2350"},{"value":"$2,401-$2,500","text":"2450"},{"value":"$2,501-$2,600","text":"2550"},{"value":"$2,601-$2,700","text":"2650"},{"value":

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:12 UTC	565	OUT	GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:13 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 7350 Connection: close Last-Modified: Wed, 09 Oct 2024 12:04:38 GMT x-amz-server-side-encryption: AES256 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 21 Mar 2025 03:31:23 GMT Cache-Control: max-age=86400 ETag: "7d4644d89e45fe92623bdd628e60e8dd" X-Cache: Hit from cloudfront Via: 1.1 1461aa0cc0d6d2fb29baf25a00e64194.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: Cc7P6bl_CnSaFKgtkGJE6x87tPcxY63_kV-oesE_lEQ_3FfPEwVizg== Age: 61070 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2025-03-21 20:29:13 UTC	7350	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 3c 4d 6f e3 48 76 f7 fd 15 32 17 d1 90 71 89 96 fc d5 36 d5 84 b7 db ed d9 f1 ae bb dd b0 bb 67 b2 eb 18 0d 4a 2c c9 d5 4d 91 5a b2 68 b7 47 d6 61 31 b7 5c 12 20 97 00 b9 05 08 16 01 82 bd 04 d9 4b 82 e4 30 3f 65 92 bd e6 2f e4 bd fa 62 51 a2 6c f7 cc 2e 90 04 69 18 2d b2 3e 5f bd 7a df f5 8a ff f5 2f ff be 36 2a d3 21 67 59 da 4a dd 82 64 24 f7 66 a6 24 72 39 a1 de 8c 8d dc b5 ec 82 5f ca a7 42 3c 5d 47 79 8b 85 8e 6e ea 84 21 bf 9d d2 6c d4 ca e9 af 4a 96 d3 76 5b 3d f4 b1 0f bc 32 2f a7 bc cc d3 16 83 41 d7 ba 1e 96 27 ba 2c 51 65 fc 2a cf 6e 5c 1a a6 f4 a6 75 94 e7 59 ee 3a 87 51 9a 66 bc 35 62 69 dc 9a 64 71 99 d0 d6 67 ce 3a 5f 77 3e 73 3c cf 1f 66 31 0d 9d 97 a7 2f de 9e 1c bd 7b 75 fa e6 dd e7 a7 6f 5f bd 70 08 9d Data Ascii: <MoHv2q6gJ,MZhGa1\ K0?e/bQl.i->_z/6!gYJd$f$r9_B<]Gyn!lJv[=2/A',Qen\uY:Qf5bidqg:_w>s<f1/{uo_p

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:12 UTC	1014	OUT	GET /main.2f10b80eae1d23a58fd4.css HTTP/1.1 Host: refinance.quickenloans.com Connection: keep-alive sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=b50atuKg7IfypPtBtfyfKPNOc6TeZ_xV0E5ZPPl2WC8-1742588949-1.0.1.1-yPXlY4a_CqVqIKvwZAWsbvE3Bph4rbl_4eqqWLRJ9DlE6nyHODQGgHz8IBf1_RjGzumSs9aclYF8inLs0fFp9yPSJgYDMgpHQ4pawWv4CD8; _lre_new=true
2025-03-21 20:29:13 UTC	833	IN	HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 20:29:13 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 42793 Connection: close CF-Ray: 9240333baf209820-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 55224 Cache-Control: public, max-age=604800 ETag: W/"a729-195b339a3b0" Expires: Fri, 28 Mar 2025 20:29:13 GMT Last-Modified: Thu, 20 Mar 2025 11:04:14 GMT Set-Cookie: _lre_new=true; path=/; Expires='Fri Mar 28 2025 20:29:13 GMT+0000 (Coordinated Universal Time)' Strict-Transport-Security: max-age=2592000 Vary: Accept-Encoding _lre_new: true x-powered-by: Express Content-Security-Policy: frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: cloudflare
2025-03-21 20:29:13 UTC	536	IN	Data Raw: 2f 2a 20 4f 43 50 20 2a 2f 0a 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 63 6b 65 74 20 53 61 6e 73 27 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 68 65 61 64 65 72 2d 71 6c 5f 6c 72 65 7b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 0a 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 0a 7d 0a 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 68 Data Ascii: /* OCP */.ocpmatch__main-container{ text-align: center; background-color: #fff !important; font-family: 'Rocket Sans' !important;}.ocpmatch__main-container .header-ql_lre{ margin-bottom: 0px; border-bottom: 0px;}.ocpmatch__main-container .h
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 3b 0a 7d 0a 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 61 69 6e 65 72 20 70 7b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 38 72 65 6d 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 34 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 37 36 37 36 37 36 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 64 69 73 63 6c 61 69 6d 65 72 4c 6f 67 6f 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 6f 63 70 2d 69 6e 74 65 72 6c 69 6e 63 78 5f 5f 63 6f 6e 74 61 Data Ascii: ;}.ocpmatch__main-container .disclaimer__container p{ font-size: 0.8rem; line-height: 14px; color: #767676; text-align: left;}.ocpmatch__main-container .disclaimerLogo{ text-align: center;} .ocpmatch__main-container .ocp-interlincx__conta
2025-03-21 20:29:13 UTC	1360	IN	Data Raw: 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 7d 0a 20 20 2e 68 65 6c 6f 63 2d 70 61 72 61 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 7d 0a 20 20 2e 68 65 6c 6f 63 2d 74 61 62 6c 65 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 7d 0a 20 20 2e 68 65 6c 6f 63 2d 74 61 62 6c 65 20 69 66 72 61 Data Ascii: ding: 10px; box-sizing: border-box; } .heloc-para { text-align: right; margin-right: 20px; font-size: 11px; } .heloc-table iframe { width: 100%; border: none; height: 100vh; overflow: hidden; } .heloc-table ifra
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 6d 61 74 63 68 5f 5f 73 75 62 5f 74 69 74 6c 65 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 70 78 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 33 32 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 32 30 70 78 20 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 41 31 41 31 41 3b 0a 20 20 7d 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 72 61 74 65 2d 64 65 74 61 69 6c 73 20 2e 72 61 74 65 2d 6e 75 6d 65 72 69 63 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 20 20 20 20 66 6f 6e Data Ascii: _main-container .match__sub_title { text-align: center; font-size: 25px; line-height: 32px; margin: 20px 0; font-weight: 700; color: #1A1A1A; } .ocpmatch__main-container .rate-details .rate-numeric { color: #FFFFFF; fon
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 20 31 72 65 6d 20 30 2e 35 72 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 33 72 65 6d 3b 0a 20 20 20 20 2f 2a 20 44 65 73 6b 74 6f 70 2f 4d 6f 6e 74 73 65 72 72 61 74 2f 48 65 61 64 65 72 20 32 20 2a 2f 0a 20 20 20 20 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 35 34 70 78 3b 0a 20 20 20 20 2f 2a 20 69 64 65 6e 74 69 63 61 6c 20 74 6f 20 62 6f 78 20 68 65 69 67 68 74 20 2a 2f 0a 20 20 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 0a 20 20 7d 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 70 Data Ascii: dding: 1rem 0.5rem; font-size: 2.3rem; /* Desktop/Montserrat/Header 2 / font-style: normal; font-weight: 700; line-height: 54px; / identical to box height */ text-align: center; } .ocpmatch__main-container .p
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 69 6e 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 7b 0a 20 20 20 20 2e 6c 6f 67 6f 62 61 72 20 7b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 34 35 70 78 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 63 6f 6e 74 65 6e 74 2e 6c 6f 77 65 72 6d 79 62 69 6c 6c 73 2e 63 6f 6d 2f 6c 72 65 2f 4c 4d 42 6c 6f 67 6f 56 32 2d 31 2e 70 6e 67 29 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 63 70 6d Data Ascii: in-width: 800px) { .logobar { height: 45px; background-image: url(https://content.lowermybills.com/lre/LMBlogoV2-1.png); background-repeat: no-repeat; background-size: auto; width: auto; margin: 5px; } .ocpm
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 72 20 2e 64 79 6e 61 6d 69 63 2d 64 61 74 61 5f 5f 61 6d 6f 75 6e 74 2d 68 6f 6c 64 65 72 20 7b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 31 34 70 78 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 32 34 36 70 78 3b 0a 20 20 7d 0a 20 20 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 68 65 61 64 6c 69 6e 65 5f 5f 72 65 73 75 6c 74 73 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 36 70 78 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 34 30 70 78 3b 0a 20 20 7d 0a 20 20 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 68 65 61 64 6c 69 6e 65 5f 5f 79 6f 75 2d 73 68 6f 75 6c 64 2d 72 65 66 69 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0a Data Ascii: r .dynamic-data__amount-holder { height: 114px; width: 246px; } .ocpmatch__main-container .headline__results { font-size: 36px; line-height: 40px; } .ocpmatch__main-container .headline__you-should-refi { font-size: 22px;
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 7d 0a 20 20 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 6c 65 6e 64 65 72 73 5f 5f 69 6d 70 6f 72 74 61 6e 74 2d 74 69 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 30 20 32 30 70 78 20 30 3b 0a 20 20 7d 0a 20 20 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 6c 65 6e 64 65 72 73 5f 5f 69 6d 70 6f 72 74 61 6e 74 2d 74 69 70 20 70 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 7d 0a 20 20 Data Ascii: t: normal; } .ocpmatch__main-container .lenders__important-tip { font-weight: normal; font-size: 14px; color: #666; padding: 0 0 20px 0; } .ocpmatch__main-container .lenders__important-tip p { padding-bottom: 20px; }
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 6f 6e 65 3b 0a 20 20 7d 0a 20 20 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 73 70 6f 6e 73 6f 72 65 64 43 6f 6e 74 65 6e 74 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 35 30 35 30 35 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0a 20 20 7d 0a 20 20 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 71 75 69 67 6f 4c 69 6e 6b 6f 66 66 43 6f 6e 74 65 6e 74 20 7b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 33 35 30 70 78 3b 0a 20 20 20 20 Data Ascii: one; } .ocpmatch__main-container .sponsoredContent { color: #505050; font-style: normal; font-size: 12px; padding-bottom: 20px; text-align: right; } .ocpmatch__main-container .quigoLinkoffContent { height: 350px;
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 61 69 6e 65 72 20 2e 6a 6d 78 44 79 6e 61 6d 69 63 44 69 73 63 6c 6f 73 75 72 65 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 38 39 38 39 38 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 66 6f 6f 74 65 72 4c 69 6e 6b 73 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 66 6f 6f 74 65 72 73 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 32 35 70 78 20 30 3b 0a 20 20 7d 0a 20 20 2e 6f 63 70 6d 61 74 63 68 5f 5f 6d 61 69 6e 2d Data Ascii: ainer .jmxDynamicDisclosure a { color: #989898; text-decoration: none; } .ocpmatch__main-container .footerLinks { color: #666; text-decoration: none; } .ocpmatch__main-container .footers { margin: 25px 0; } .ocpmatch__main-

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:12 UTC	561	OUT	GET /scripts/v1/push/5fa1b4cbe02a560012bcbdf7 HTTP/1.1 Host: api.pushnami.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:13 UTC	418	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 94572 Connection: close Date: Fri, 21 Mar 2025 20:29:13 GMT Cache-Control: no-cache Accept-Ranges: bytes Vary: accept-encoding X-Cache: Miss from cloudfront Via: 1.1 65cf746d404c73d4aef0b35e7fcab946.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: 0YbeELw8atTjx6pKEoENiOQF49sNuquhrD2Gf1KAkUSfodKFE3iPUA==
2025-03-21 20:29:13 UTC	8214	IN	Data Raw: 2f 2f 0a 2f 2f 20 54 68 65 20 65 6d 70 74 79 20 6c 69 6e 65 20 61 62 6f 76 65 20 69 73 20 63 72 69 74 69 63 61 6c 20 66 6f 72 20 74 65 6d 70 6c 61 74 69 6e 67 20 6d 61 69 6e 2e 62 65 74 61 20 69 6e 20 74 68 65 20 63 75 72 72 65 6e 74 20 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 0a 2f 2f 20 53 74 61 72 74 20 54 65 73 74 20 4d 6f 64 65 20 44 65 74 65 63 74 69 6f 6e 20 3b 0a 0a 2f 2f 20 0a 76 61 72 20 69 73 52 6f 6c 6c 62 61 72 20 3d 20 75 6e 64 65 66 69 6e 65 64 3b 0a 2f 2f 20 61 64 64 20 72 6f 6c 6c 62 61 72 20 0a 76 61 72 20 70 75 73 68 57 72 61 70 20 3d 20 7b 0a 20 20 20 20 77 72 61 70 4f 62 6a 3a 20 66 75 6e 63 74 69 6f 6e 20 28 73 65 72 76 69 63 65 29 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 66 6e 20 69 6e 20 73 65 72 76 69 63 65 29 Data Ascii: //// The empty line above is critical for templating main.beta in the current implementation// Start Test Mode Detection ;// var isRollbar = undefined;// add rollbar var pushWrap = { wrapObj: function (service) { for (var fn in service)
2025-03-21 20:29:13 UTC	6016	IN	Data Raw: 5d 27 20 7c 7c 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2e 6d 61 74 63 68 28 2f 5e 31 32 37 28 3f 3a 5c 2e 28 3f 3a 32 35 5b 30 2d 35 5d 7c 32 5b 30 2d 34 5d 5b 30 2d 39 5d 7c 5b 30 31 5d 3f 5b 30 2d 39 5d 5b 30 2d 39 5d 3f 29 29 7b 33 7d 24 2f 29 29 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 50 75 73 68 6e 61 6d 69 20 2d 20 65 72 72 6f 72 20 6e 6f 74 20 53 53 4c 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 75 73 68 6e 61 6d 69 54 72 61 63 6b 28 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 3a 20 27 77 65 62 70 75 73 68 2d 65 72 72 6f 72 2d 6e 6f 74 2d 73 73 6c 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ]' \|\| window.location.hostname.match(/^127(?:\.(?:25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)){3}$/)))) { console.error("Pushnami - error not SSL"); pushnamiTrack({ event: 'webpush-error-not-ssl',
2025-03-21 20:29:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 79 6c 6f 61 64 2e 72 65 6e 65 77 54 68 72 65 73 68 6f 6c 64 20 3d 20 6f 70 74 73 2e 72 65 6e 65 77 54 68 72 65 73 68 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 65 74 63 68 28 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 70 75 73 68 6e 61 6d 69 2e 63 6f 6d 2f 61 70 69 2f 70 75 73 68 2f 77 61 74 65 72 66 61 6c 6c 2f 65 6e 72 6f 6c 6c 6d 65 6e 74 27 2c 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 65 74 68 6f 64 3a 20 27 50 4f 53 54 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 3a 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 70 61 79 6c 6f 61 64 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 6f 64 65 3a 20 27 Data Ascii: payload.renewThreshold = opts.renewThreshold; } fetch('https://api.pushnami.com/api/push/waterfall/enrollment', { method: 'POST', body: JSON.stringify(payload), mode: '
2025-03-21 20:29:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 63 6f 70 65 49 64 3a 20 77 65 62 73 69 74 65 49 64 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 3a 20 28 65 72 72 20 26 26 20 65 72 72 2e 6d 65 73 73 61 67 65 29 20 3f 20 65 72 72 2e 6d 65 73 73 61 67 65 20 3a 20 6e 75 6c 6c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 69 73 52 6f 6c 6c 62 61 72 29 20 52 6f 6c 6c 62 61 72 2e 65 72 72 6f 72 28 Data Ascii: scopeId: websiteId, e: (err && err.message) ? err.message : null }); if (isRollbar) Rollbar.error(
2025-03-21 20:29:13 UTC	9224	IN	Data Raw: 73 20 45 69 74 68 65 72 20 57 61 79 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 70 73 69 64 29 20 72 65 74 75 72 6e 20 50 75 73 68 6e 61 6d 69 3b 20 2f 2f 20 52 65 74 75 72 6e 20 69 66 20 6e 6f 74 20 73 75 62 73 63 72 69 62 65 64 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 54 4f 44 4f 3a 20 52 65 6d 6f 76 65 20 68 61 72 64 63 6f 64 69 6e 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 44 65 61 63 74 69 76 61 74 65 73 20 61 6e 79 20 75 74 6d 5f 73 6f 75 72 63 65 20 27 72 72 6d 27 20 73 75 62 73 63 72 69 62 65 72 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 54 65 73 74 69 6e 67 20 32 64 62 31 39 66 34 32 61 65 35 39 31 32 36 66 33 34 64 64 39 35 62 37 63 33 34 38 35 35 35 35 0a 20 20 Data Ascii: s Either Way if (!psid) return Pushnami; // Return if not subscribed // TODO: Remove hardcoding // Deactivates any utm_source 'rrm' subscribers // Testing 2db19f42ae59126f34dd95b7c3485555
2025-03-21 20:29:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6f 70 74 49 6e 43 73 73 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 63 72 69 70 74 2e 73 72 63 20 3d 20 74 77 6f 53 74 65 70 53 63 72 69 70 74 55 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: document.getElementsByTagName("head")[0].appendChild(optInCss); var script = document.createElement("script"); script.src = twoStepScriptUrl;
2025-03-21 20:29:13 UTC	8232	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 50 75 73 68 6e 61 6d 69 20 2d 20 75 6e 73 75 62 73 63 72 69 62 65 64 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 50 75 73 68 6e 61 6d 69 20 2d 20 75 6e 73 75 62 73 63 72 69 62 65 20 5b 61 70 69 5d 20 65 72 72 6f 72 3a 20 22 2c 20 65 72 72 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: console.log('Pushnami - unsubscribed'); return true; } else { console.error("Pushnami - unsubscribe [api] error: ", err);
2025-03-21 20:29:13 UTC	13734	IN	Data Raw: 6e 20 69 28 75 2c 21 30 29 3b 76 61 72 20 73 3d 6e 65 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 75 2b 22 27 22 29 3b 74 68 72 6f 77 20 73 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 73 7d 76 61 72 20 64 3d 72 5b 75 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6e 5b 75 5d 5b 30 5d 2e 63 61 6c 6c 28 64 2e 65 78 70 6f 72 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 6e 5b 75 5d 5b 31 5d 5b 65 5d 3b 72 65 74 75 72 6e 20 74 28 72 3f 72 3a 65 29 7d 2c 64 2c 64 2e 65 78 70 6f 72 74 73 2c 65 2c 6e 2c 72 2c 6f 29 7d 72 65 74 75 72 6e 20 72 5b 75 5d 2e 65 78 70 6f 72 74 73 7d 66 6f 72 28 76 61 72 20 69 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 Data Ascii: n i(u,!0);var s=new Error("Cannot find module '"+u+"'");throw s.code="MODULE_NOT_FOUND",s}var d=r[u]={exports:{}};n[u][0].call(d.exports,function(e){var r=n[u][1][e];return t(r?r:e)},d,d.exports,e,n,r,o)}return r[u].exports}for(var i="function"==typeof re

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:12 UTC	999	OUT	GET /main.2f10b80eae1d23a58fd4.js HTTP/1.1 Host: refinance.quickenloans.com Connection: keep-alive sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=b50atuKg7IfypPtBtfyfKPNOc6TeZ_xV0E5ZPPl2WC8-1742588949-1.0.1.1-yPXlY4a_CqVqIKvwZAWsbvE3Bph4rbl_4eqqWLRJ9DlE6nyHODQGgHz8IBf1_RjGzumSs9aclYF8inLs0fFp9yPSJgYDMgpHQ4pawWv4CD8; _lre_new=true
2025-03-21 20:29:13 UTC	851	IN	HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 20:29:13 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 2173590 Connection: close CF-Ray: 9240333bbbb51b53-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 47853 Cache-Control: public, max-age=604800 ETag: W/"212a96-195b339a3b0" Expires: Fri, 28 Mar 2025 20:29:13 GMT Last-Modified: Thu, 20 Mar 2025 11:04:14 GMT Set-Cookie: _lre_new=true; path=/; Expires='Fri Mar 28 2025 20:29:13 GMT+0000 (Coordinated Universal Time)' Strict-Transport-Security: max-age=2592000 Vary: Accept-Encoding _lre_new: true x-powered-by: Express Content-Security-Policy: frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: cloudflare
2025-03-21 20:29:13 UTC	518	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 61 69 6e 2e 32 66 31 30 62 38 30 65 61 65 31 64 32 33 61 35 38 66 64 34 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 28 29 3d 3e 7b 76 61 72 20 65 2c 74 2c 6e 3d 7b 35 35 33 36 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 56 69 73 69 74 6f 72 43 6c 69 63 6b 50 72 6f 76 69 64 65 72 3d 74 2e 50 72 65 73 65 6e 74 61 74 69 6f 6e 43 6c 69 63 6b 50 72 6f 76 69 64 65 72 3d 74 2e 43 6c 69 63 6b 56 69 73 69 74 6f 72 43 6f 6e 74 65 78 74 3d 74 2e 43 6c 69 Data Ascii: /! For license information please see main.2f10b80eae1d23a58fd4.js.LICENSE.txt /(()=>{var e,t,n={5536:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.VisitorClickProvider=t.PresentationClickProvider=t.ClickVisitorContext=t.Cli
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 6f 6c 73 29 7b 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 72 3d 72 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 74 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 72 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 31 3b 74 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 21 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3a 7b 7d 3b 74 25 32 3f 63 28 4f Data Ascii: ols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function u(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?c(O
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 61 69 67 6e 49 6e 69 74 53 74 61 74 65 3a 78 2c 70 72 65 73 65 6e 74 61 74 69 6f 6e 49 6e 69 74 53 74 61 74 65 3a 5f 7d 3d 28 30 2c 69 2e 69 6e 69 74 29 28 79 29 2c 77 3d 74 2e 56 69 73 69 74 6f 72 43 6c 69 63 6b 50 72 6f 76 69 64 65 72 3d 79 3f 65 3d 3e 7b 6c 65 74 7b 63 68 69 6c 64 72 65 6e 3a 74 7d 3d 65 3b 72 65 74 75 72 6e 20 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 72 2e 64 65 66 61 75 6c 74 2e 46 72 61 67 6d 65 6e 74 2c 6e 75 6c 6c 2c 74 29 7d 3a 65 3d 3e 7b 6c 65 74 7b 63 6f 6f 6b 69 65 53 65 74 74 69 6e 67 73 3a 74 3d 76 2c 73 65 73 73 69 6f 6e 4c 65 6e 67 74 68 3a 6e 3d 31 38 65 35 2c 65 6e 64 70 6f 69 6e 74 3a 6f 3d 22 2f 61 70 69 2f 74 72 61 63 6b 69 6e 67 22 2c 64 65 76 69 63 65 41 74 6c 61 73 53 63 72 69 70 74 Data Ascii: aignInitState:x,presentationInitState:_}=(0,i.init)(y),w=t.VisitorClickProvider=y?e=>{let{children:t}=e;return r.default.createElement(r.default.Fragment,null,t)}:e=>{let{cookieSettings:t=v,sessionLength:n=18e5,endpoint:o="/api/tracking",deviceAtlasScript
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 28 21 68 2e 63 6c 69 63 6b 2e 64 61 56 61 6c 26 26 21 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 64 65 76 69 63 65 61 74 6c 61 73 22 29 29 7b 63 6f 6e 73 74 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 72 2e 73 72 63 3d 69 2c 72 2e 69 64 3d 22 64 65 76 69 63 65 61 74 6c 61 73 22 2c 72 2e 66 65 74 63 68 70 72 69 6f 72 69 74 79 3d 22 68 69 67 68 22 2c 72 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 74 2c 21 31 29 2c 72 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 65 72 72 6f 72 22 2c 6e 2c 21 31 29 2c 72 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 28 28 29 Data Ascii: (!h.click.daVal&&!document.querySelector("#deviceatlas")){const r=document.createElement("script");r.src=i,r.id="deviceatlas",r.fetchpriority="high",r.addEventListener("load",t,!1),r.addEventListener("error",n,!1),r.addEventListener("readystatechange",(()
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 63 61 6d 70 61 69 67 6e 5f 63 6c 69 63 6b 22 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6f 7c 7c 22 7b 7d 22 29 29 7d 29 2c 5b 6f 5d 29 3b 63 6f 6e 73 74 20 6c 3d 7b 63 61 6d 70 61 69 67 6e 3a 6f 2c 75 70 64 61 74 65 53 6f 75 72 63 65 28 65 29 7b 69 28 7b 74 79 70 65 3a 22 75 70 64 61 74 65 5f 73 6f 75 72 63 65 22 2c 70 61 79 6c 6f 61 64 3a 7b 73 6f 75 72 63 65 49 64 3a 65 7d 7d 29 7d 2c 64 69 73 70 61 74 63 68 3a 69 7d 3b 72 65 74 75 72 6e 20 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 68 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 6c 7d 2c 74 29 7d 2c 77 2e 70 72 6f 70 54 79 70 65 73 3d 7b 63 6f 6f 6b 69 65 53 65 74 74 69 6e 67 73 3a 6f 2e 64 65 66 61 Data Ascii: ocalStorage.setItem("campaign_click",JSON.stringify(o\|\|"{}"))}),[o]);const l={campaign:o,updateSource(e){i({type:"update_source",payload:{sourceId:e}})},dispatch:i};return r.default.createElement(h.Provider,{value:l},t)},w.propTypes={cookieSettings:o.defa
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 63 6c 69 63 6b 2e 76 69 73 69 74 6f 72 49 64 2c 73 2e 63 6f 6f 6b 69 65 73 2e 63 6c 69 63 6b 7c 7c 28 75 2e 76 65 72 74 69 63 61 6c 73 3d 5b 5d 2c 75 2e 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 3d 5b 5d 29 2c 7b 63 61 6d 70 61 69 67 6e 49 6e 69 74 53 74 61 74 65 3a 63 2c 70 72 65 73 65 6e 74 61 74 69 6f 6e 49 6e 69 74 53 74 61 74 65 3a 75 2c 69 6e 69 74 69 61 6c 53 74 61 74 65 3a 73 7d 7d 2c 6e 28 32 37 34 39 35 29 2c 6e 28 35 37 34 36 29 2c 6e 28 36 32 39 35 33 29 2c 6e 28 34 38 34 30 38 29 3b 76 61 72 20 72 2c 6f 3d 6e 28 31 30 36 31 31 29 2c 69 3d 28 72 3d 6e 28 34 30 37 37 37 29 29 26 26 72 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 72 3a 7b 64 65 66 61 75 6c 74 3a 72 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e Data Ascii: click.visitorId,s.cookies.click\|\|(u.verticals=[],u.presentations=[]),{campaignInitState:c,presentationInitState:u,initialState:s}},n(27495),n(5746),n(62953),n(48408);var r,o=n(10611),i=(r=n(40777))&&r.__esModule?r:{default:r};function a(e,t){var n=Object.
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 74 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 72 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 31 3b 74 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 21 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3a 7b 7d 3b 74 25 32 3f 72 28 4f 62 6a 65 63 74 28 6e 29 2c 21 30 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 28 65 2c 74 2c 6e 5b 74 5d 29 7d 29 29 3a 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 Data Ascii: tion(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function o(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?r(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnP
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 6f 6c 65 2e 65 72 72 6f 72 28 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 61 6c 72 65 61 64 79 20 65 78 69 73 74 73 22 29 2c 65 29 3a 6f 28 6f 28 7b 7d 2c 65 29 2c 7b 7d 2c 7b 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 3a 65 2e 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 2e 63 6f 6e 63 61 74 28 5b 74 2e 70 61 79 6c 6f 61 64 2e 70 72 65 73 65 6e 74 61 74 69 6f 6e 4e 61 6d 65 5d 29 2c 74 65 73 74 73 3a 65 2e 74 65 73 74 73 26 26 65 2e 74 65 73 74 73 2e 63 6f 6e 63 61 74 28 5b 74 2e 70 61 79 6c 6f 61 64 2e 74 65 73 74 49 64 5d 29 7c 7c 5b 74 2e 70 61 79 6c 6f 61 64 2e 74 65 73 74 49 64 5d 7d 29 3b 63 61 73 65 22 72 65 67 69 73 74 65 72 5f 76 65 72 74 69 63 61 6c 5f 70 72 65 73 65 6e 74 61 74 69 6f 6e 22 3a 72 65 74 75 72 6e 20 6f 28 6f 28 7b 7d 2c 65 29 2c 7b 7d 2c 7b Data Ascii: ole.error("presentation already exists"),e):o(o({},e),{},{presentations:e.presentations.concat([t.payload.presentationName]),tests:e.tests&&e.tests.concat([t.payload.testId])\|\|[t.payload.testId]});case"register_vertical_presentation":return o(o({},e),{},{
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 6f 28 7b 7d 2c 65 29 2c 7b 7d 2c 7b 63 6c 69 63 6b 3a 6f 28 6f 28 7b 7d 2c 65 2e 63 6c 69 63 6b 29 2c 7b 7d 2c 7b 76 69 73 69 74 6f 72 49 64 3a 74 2e 70 61 79 6c 6f 61 64 2e 76 69 73 69 74 6f 72 49 64 2c 73 6f 75 72 63 65 49 64 3a 74 2e 70 61 79 6c 6f 61 64 2e 73 6f 75 72 63 65 49 64 7d 29 2c 63 6f 6f 6b 69 65 73 3a 6f 28 6f 28 7b 7d 2c 65 2e 63 6f 6f 6b 69 65 73 29 2c 7b 7d 2c 7b 76 69 73 69 74 6f 72 49 64 3a 74 2e 70 61 79 6c 6f 61 64 2e 76 69 73 69 74 6f 72 49 64 2c 73 6f 75 72 63 65 49 64 3a 74 2e 70 61 79 6c 6f 61 64 2e 73 6f 75 72 63 65 49 64 7d 29 7d 29 3b 63 61 73 65 22 64 65 76 69 63 65 5f 61 74 6c 61 73 22 3a 72 65 74 75 72 6e 20 6f 28 6f 28 7b 7d 2c 65 29 2c 7b 7d 2c 7b 63 6c 69 63 6b 3a 6f 28 6f 28 7b 7d 2c 65 2e 63 6c 69 63 6b 29 2c 7b 7d 2c Data Ascii: o({},e),{},{click:o(o({},e.click),{},{visitorId:t.payload.visitorId,sourceId:t.payload.sourceId}),cookies:o(o({},e.cookies),{},{visitorId:t.payload.visitorId,sourceId:t.payload.sourceId})});case"device_atlas":return o(o({},e),{},{click:o(o({},e.click),{},
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 64 69 73 70 6c 61 79 4e 61 6d 65 3d 22 50 61 67 65 56 65 72 74 69 63 61 6c 22 2c 74 2e 50 61 67 65 56 65 72 74 69 63 61 6c 3d 65 3d 3e 7b 6c 65 74 7b 63 68 69 6c 64 72 65 6e 3a 74 2c 76 65 72 74 69 63 61 6c 3a 6e 2c 70 72 65 73 65 6e 74 61 74 69 6f 6e 49 64 3a 6f 2c 70 72 65 73 65 6e 74 61 74 69 6f 6e 4e 61 6d 65 3a 61 2c 74 65 73 74 49 64 3a 6c 2c 66 6c 6f 77 49 64 3a 63 2c 65 6e 64 70 6f 69 6e 74 3a 75 7d 3d 65 3b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 7b 76 65 72 74 69 63 61 6c 3a 6e 2c 70 72 65 73 65 6e 74 61 74 69 6f 6e 49 64 3a 6f 2c 70 72 65 73 65 6e 74 61 74 69 6f Data Ascii: displayName="PageVertical",t.PageVertical=e=>{let{children:t,vertical:n,presentationId:o,presentationName:a,testId:l,flowId:c,endpoint:u}=e;return"undefined"!=typeof window?r.default.createElement(i.Provider,{value:{vertical:n,presentationId:o,presentatio

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:13 UTC	553	OUT	GET /datadog-rum-v3.js HTTP/1.1 Host: www.datadoghq-browser-agent.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:13 UTC	529	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 117677 Connection: close Date: Fri, 21 Mar 2025 20:29:14 GMT Last-Modified: Mon, 03 Jan 2022 16:36:14 GMT ETag: "647fda9a4d3d74344732d76cf1fff47c" Cache-Control: max-age=14400, s-maxage=60 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 609b92127df3778f333c9eba7213368e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P4 X-Amz-Cf-Id: hca6sTGkdmLyyYnLKWXZVfv-4QARorcwywplZSVCMUXEO542ovOr_g== Timing-Allow-Origin: *
2025-03-21 20:29:13 UTC	15855	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 74 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 65 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 69 29 26 26 28 74 5b 69 5d 3d 65 5b 69 5d 29 3b 72 65 74 75 72 6e 20 74 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 65 29 7b 76 61 72 Data Ascii: !function(){"use strict";var t=function(){return(t=Object.assign\|\|function(t){for(var e,n=1,r=arguments.length;n<r;n++)for(var i in e=arguments[n])Object.prototype.hasOwnProperty.call(e,i)&&(t[i]=e[i]);return t}).apply(this,arguments)};function e(t,e){var
2025-03-21 20:29:13 UTC	135	IN	Data Raw: 28 74 29 7b 76 61 72 20 65 3d 44 61 74 65 2e 6e 6f 77 28 29 2d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 72 65 74 75 72 6e 20 65 3e 53 74 28 29 3f 4d 61 74 68 2e 72 6f 75 6e 64 28 65 2b 74 29 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4d 61 74 68 2e 72 6f 75 6e 64 28 53 74 28 29 2b 74 29 7d 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 74 29 7b 72 65 74 75 72 6e 20 53 28 Data Ascii: (t){var e=Date.now()-performance.now();return e>St()?Math.round(e+t):function(t){return Math.round(St()+t)}(t)}function gt(t){return S(
2025-03-21 20:29:13 UTC	1003	IN	Data Raw: 74 29 3f 67 28 31 65 36 2a 74 2c 30 29 3a 74 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 29 7b 72 65 74 75 72 6e 20 44 61 74 65 2e 6e 6f 77 28 29 7d 66 75 6e 63 74 69 6f 6e 20 62 74 28 29 7b 72 65 74 75 72 6e 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 7d 66 75 6e 63 74 69 6f 6e 20 45 74 28 29 7b 72 65 74 75 72 6e 7b 72 65 6c 61 74 69 76 65 3a 62 74 28 29 2c 74 69 6d 65 53 74 61 6d 70 3a 79 74 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 77 74 28 29 7b 72 65 74 75 72 6e 7b 72 65 6c 61 74 69 76 65 3a 30 2c 74 69 6d 65 53 74 61 6d 70 3a 53 74 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 54 74 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 65 2d 74 7d 66 75 6e 63 74 69 6f 6e 20 53 74 28 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 68 74 26 26 28 68 74 3d 70 65 72 Data Ascii: t)?g(1e6*t,0):t}function yt(){return Date.now()}function bt(){return performance.now()}function Et(){return{relative:bt(),timeStamp:yt()}}function wt(){return{relative:0,timeStamp:St()}}function Tt(t,e){return e-t}function St(){return void 0===ht&&(ht=per
2025-03-21 20:29:13 UTC	16384	IN	Data Raw: 65 6e 74 28 22 61 22 29 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 29 7b 76 61 72 20 69 3d 28 6e 3d 64 6f 63 75 6d 65 6e 74 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 63 72 65 61 74 65 48 54 4d 4c 44 6f 63 75 6d 65 6e 74 28 22 22 29 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 62 61 73 65 22 29 3b 69 2e 68 72 65 66 3d 65 2c 6e 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 6e 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 72 65 74 75 72 6e 20 72 2e 68 72 65 66 3d 74 2c 72 7d 76 61 72 20 4c 74 3d 7b 61 6c 74 65 72 6e 61 74 65 3a 7b 6c 6f 67 73 3a 22 6c 6f 67 73 22 2c 72 75 6d 3a 22 72 75 6d 22 2c 73 65 73 73 69 6f 6e 52 65 70 6c 61 79 3a 22 73 65 73 73 69 6f 6e 2d 72 65 70 6c 61 79 22 7d 2c 63 6c 61 73 73 69 63 3a Data Ascii: ent("a");if(void 0!==e){var i=(n=document.implementation.createHTMLDocument("")).createElement("base");i.href=e,n.head.appendChild(i),n.body.appendChild(r)}return r.href=t,r}var Lt={alternate:{logs:"logs",rum:"rum",sessionReplay:"session-replay"},classic:
2025-03-21 20:29:13 UTC	16384	IN	Data Raw: 64 54 72 61 63 6b 65 64 53 65 73 73 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6e 2e 66 69 6e 64 41 63 74 69 76 65 53 65 73 73 69 6f 6e 28 74 29 3b 69 66 28 65 26 26 46 65 28 65 2e 74 72 61 63 6b 69 6e 67 54 79 70 65 29 29 72 65 74 75 72 6e 7b 69 64 3a 65 2e 69 64 2c 68 61 73 52 65 70 6c 61 79 50 6c 61 6e 3a 65 2e 74 72 61 63 6b 69 6e 67 54 79 70 65 3d 3d 3d 7a 65 2e 54 52 41 43 4b 45 44 5f 52 45 50 4c 41 59 2c 68 61 73 4c 69 74 65 50 6c 61 6e 3a 65 2e 74 72 61 63 6b 69 6e 67 54 79 70 65 3d 3d 3d 7a 65 2e 54 52 41 43 4b 45 44 5f 4c 49 54 45 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 46 65 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 3d 3d 7a 65 2e 54 52 41 43 4b 45 44 5f 4c 49 54 45 7c 7c 74 3d 3d 3d 7a 65 2e 54 52 41 43 4b 45 44 5f 52 45 50 Data Ascii: dTrackedSession:function(t){var e=n.findActiveSession(t);if(e&&Fe(e.trackingType))return{id:e.id,hasReplayPlan:e.trackingType===ze.TRACKED_REPLAY,hasLitePlan:e.trackingType===ze.TRACKED_LITE}}}}function Fe(t){return t===ze.TRACKED_LITE\|\|t===ze.TRACKED_REP
2025-03-21 20:29:13 UTC	1024	IN	Data Raw: 65 78 74 3a 6f 2c 73 61 76 65 64 43 6f 6d 6d 6f 6e 43 6f 6e 74 65 78 74 3a 61 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 7b 64 61 74 65 3a 74 2e 73 74 61 72 74 43 6c 6f 63 6b 73 2e 74 69 6d 65 53 74 61 6d 70 2c 65 72 72 6f 72 3a 7b 69 64 3a 6d 28 29 2c 6d 65 73 73 61 67 65 3a 74 2e 6d 65 73 73 61 67 65 2c 72 65 73 6f 75 72 63 65 3a 74 2e 72 65 73 6f 75 72 63 65 3f 7b 6d 65 74 68 6f 64 3a 74 2e 72 65 73 6f 75 72 63 65 2e 6d 65 74 68 6f 64 2c 73 74 61 74 75 73 5f 63 6f 64 65 3a 74 2e 72 65 73 6f 75 72 63 65 2e 73 74 61 74 75 73 43 6f 64 65 2c 75 72 6c 3a 74 2e 72 65 73 6f 75 72 63 65 2e 75 72 6c 7d 3a 76 6f 69 64 20 30 2c 73 6f 75 72 63 65 3a 74 2e 73 6f 75 72 63 65 2c 73 74 61 63 6b 3a 74 2e 73 74 61 63 6b 2c 68 61 6e 64 6c 69 6e 67 Data Ascii: ext:o,savedCommonContext:a},function(t,e){var n={date:t.startClocks.timeStamp,error:{id:m(),message:t.message,resource:t.resource?{method:t.resource.method,status_code:t.resource.statusCode,url:t.resource.url}:void 0,source:t.source,stack:t.stack,handling
2025-03-21 20:29:13 UTC	11754	IN	Data Raw: 75 72 6e 20 74 2e 74 6f 4a 53 4f 4e 28 29 7d 29 29 2e 66 69 6c 74 65 72 28 69 65 29 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 3d 65 2c 72 3d 74 2e 73 74 61 72 74 43 6c 6f 63 6b 73 2e 72 65 6c 61 74 69 76 65 2c 69 3d 42 6e 28 7b 73 74 61 72 74 54 69 6d 65 3a 74 2e 73 74 61 72 74 43 6c 6f 63 6b 73 2e 72 65 6c 61 74 69 76 65 2c 64 75 72 61 74 69 6f 6e 3a 74 2e 64 75 72 61 74 69 6f 6e 7d 29 2c 6f 3d 31 2c 6e 2e 73 74 61 72 74 54 69 6d 65 3e 3d 72 2d 6f 26 26 42 6e 28 6e 29 3c 3d 69 2b 6f 3b 76 61 72 20 6e 2c 72 2c 69 2c 6f 7d 29 29 3b 72 65 74 75 72 6e 20 31 3d 3d 3d 72 2e 6c 65 6e 67 74 68 3f 72 5b 30 5d 3a 32 3d 3d 3d 72 2e 6c 65 6e 67 74 68 26 26 42 6e 28 28 6e 3d 72 29 5b 30 5d 29 3c 3d 6e 5b 31 5d 2e 73 74 61 Data Ascii: urn t.toJSON()})).filter(ie).filter((function(e){return n=e,r=t.startClocks.relative,i=Bn({startTime:t.startClocks.relative,duration:t.duration}),o=1,n.startTime>=r-o&&Bn(n)<=i+o;var n,r,i,o}));return 1===r.length?r[0]:2===r.length&&Bn((n=r)[0])<=n[1].sta
2025-03-21 20:29:13 UTC	16384	IN	Data Raw: 28 22 4d 45 54 41 22 3d 3d 3d 74 2e 6e 6f 64 65 4e 61 6d 65 29 7b 76 61 72 20 65 3d 69 28 22 6e 61 6d 65 22 29 2c 6e 3d 69 28 22 72 65 6c 22 29 2c 72 3d 69 28 22 70 72 6f 70 65 72 74 79 22 29 3b 72 65 74 75 72 6e 2f 5e 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 69 6c 65 28 69 6d 61 67 65 7c 63 6f 6c 6f 72 29 24 2f 2e 74 65 73 74 28 65 29 7c 7c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3d 3d 3d 65 7c 7c 22 69 63 6f 6e 22 3d 3d 3d 6e 7c 7c 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 3d 3d 3d 6e 7c 7c 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 3d 3d 3d 6e 7c 7c 22 6b 65 79 77 6f 72 64 73 22 3d 3d 3d 65 7c 7c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3d 3d 3d 65 7c 7c 2f 5e 28 6f 67 7c 74 77 69 74 74 65 72 7c 66 62 29 3a 2f 2e 74 65 73 Data Ascii: ("META"===t.nodeName){var e=i("name"),n=i("rel"),r=i("property");return/^msapplication-tile(image\|color)$/.test(e)\|\|"application-name"===e\|\|"icon"===n\|\|"apple-touch-icon"===n\|\|"shortcut icon"===n\|\|"keywords"===e\|\|"description"===e\|\|/^(og\|twitter\|fb):/.tes
2025-03-21 20:29:13 UTC	16384	IN	Data Raw: 69 3d 36 65 34 3b 66 75 6e 63 74 69 6f 6e 20 45 69 28 74 2c 65 2c 6e 2c 72 2c 69 2c 6f 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 72 2c 69 29 7b 76 6f 69 64 20 30 3d 3d 3d 69 26 26 28 69 3d 77 69 6e 64 6f 77 29 3b 76 61 72 20 6f 3d 7b 73 74 61 74 75 73 3a 30 2c 6e 65 78 74 53 65 67 6d 65 6e 74 43 72 65 61 74 69 6f 6e 52 65 61 73 6f 6e 3a 22 69 6e 69 74 22 7d 2c 61 3d 74 2e 73 75 62 73 63 72 69 62 65 28 47 74 2e 56 49 45 57 5f 43 52 45 41 54 45 44 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 63 28 22 76 69 65 77 5f 63 68 61 6e 67 65 22 29 7d 29 29 2e 75 6e 73 75 62 73 63 72 69 62 65 2c 73 3d 74 2e 73 75 62 73 63 72 69 62 65 28 47 74 2e 42 45 46 4f 52 45 5f 55 4e 4c 4f 41 44 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 63 28 22 62 65 66 6f Data Ascii: i=6e4;function Ei(t,e,n,r,i,o){return function(t,e,n,r,i){void 0===i&&(i=window);var o={status:0,nextSegmentCreationReason:"init"},a=t.subscribe(Gt.VIEW_CREATED,(function(){c("view_change")})).unsubscribe,s=t.subscribe(Gt.BEFORE_UNLOAD,(function(){c("befo
2025-03-21 20:29:13 UTC	2048	IN	Data Raw: 32 2c 31 32 38 2c 32 35 36 2c 62 65 29 2c 6e 65 77 20 54 65 28 33 32 2c 31 32 38 2c 32 35 38 2c 31 30 32 34 2c 62 65 29 2c 6e 65 77 20 54 65 28 33 32 2c 32 35 38 2c 32 35 38 2c 34 30 39 36 2c 62 65 29 5d 2c 43 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 77 69 6e 64 6f 77 5f 73 69 7a 65 3d 32 2a 74 2e 77 5f 73 69 7a 65 2c 6c 65 28 74 2e 68 65 61 64 29 2c 74 2e 6d 61 78 5f 6c 61 7a 79 5f 6d 61 74 63 68 3d 53 65 5b 74 2e 6c 65 76 65 6c 5d 2e 6d 61 78 5f 6c 61 7a 79 2c 74 2e 67 6f 6f 64 5f 6d 61 74 63 68 3d 53 65 5b 74 2e 6c 65 76 65 6c 5d 2e 67 6f 6f 64 5f 6c 65 6e 67 74 68 2c 74 2e 6e 69 63 65 5f 6d 61 74 63 68 3d 53 65 5b 74 2e 6c 65 76 65 6c 5d 2e 6e 69 63 65 5f 6c 65 6e 67 74 68 2c 74 2e 6d 61 78 5f 63 68 61 69 6e 5f 6c 65 6e 67 74 68 3d 53 65 5b 74 Data Ascii: 2,128,256,be),new Te(32,128,258,1024,be),new Te(32,258,258,4096,be)],Ce=function(t){t.window_size=2*t.w_size,le(t.head),t.max_lazy_match=Se[t.level].max_lazy,t.good_match=Se[t.level].good_length,t.nice_match=Se[t.level].nice_length,t.max_chain_length=Se[t

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:13 UTC	601	OUT	GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1 Host: static.cloudflareinsights.com Connection: keep-alive Origin: https://refinance.quickenloans.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:13 UTC	373	IN	HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 20:29:13 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 19948 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 ETag: W/"2024.6.1" Last-Modified: Thu, 06 Jun 2024 15:52:56 GMT Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 92403340dc218c6b-EWR
2025-03-21 20:29:13 UTC	996	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 33 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 32 35 36 3b 2b 2b 6e 29 74 5b 6e 5d 3d 28 6e 2b 32 35 36 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2e 73 75 62 73 74 72 28 31 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 7c 7c 30 2c 69 3d 74 3b 72 65 74 75 72 6e 5b 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b Data Ascii: !function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var r=n\|\|0,i=t;return[i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r+
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 3b 69 66 28 61 5b 36 5d 3d 31 35 26 61 5b 36 5d 7c 36 34 2c 61 5b 38 5d 3d 36 33 26 61 5b 38 5d 7c 31 32 38 2c 74 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 31 36 3b 2b 2b 63 29 74 5b 6f 2b 63 5d 3d 61 5b 63 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 69 28 61 29 7d 7d 2c 31 36 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 Data Ascii: ;if(a[6]=15&a[6]\|64,a[8]=63&a[8]\|128,t)for(var c=0;c<16;++c)t[o+c]=a[c];return t\|\|i(a)}},168:function(e,t,n){"use strict";var r=this&&this.__assign\|\|function(){return r=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var i in t=arg
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 72 63 68 50 61 72 61 6d 73 29 7b 76 61 72 20 79 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 67 2e 72 65 70 6c 61 63 65 28 2f 5e 5b 5e 5c 3f 5d 2b 5c 3f 3f 2f 2c 22 22 29 29 2c 68 3d 79 2e 67 65 74 28 22 74 6f 6b 65 6e 22 29 3b 68 26 26 28 70 2e 74 6f 6b 65 6e 3d 68 29 3b 76 61 72 20 54 3d 79 2e 67 65 74 28 22 73 70 61 22 29 3b 70 2e 73 70 61 3d 6e 75 6c 6c 3d 3d 3d 54 7c 7c 22 74 72 75 65 22 3d 3d 3d 54 7d 7d 70 26 26 22 6d 75 6c 74 69 22 21 3d 3d 70 2e 6c 6f 61 64 26 26 28 70 2e 6c 6f 61 64 3d 22 73 69 6e 67 6c 65 22 29 2c 77 69 6e 64 6f 77 2e 5f 5f 63 66 42 65 61 63 6f 6e 3d 70 7d 69 66 28 73 26 26 70 26 26 70 2e 74 6f 6b 65 6e 29 7b 76 61 72 20 77 2c 53 2c 62 3d 21 31 3b 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 Data Ascii: rchParams){var y=new URLSearchParams(g.replace(/^[^\?]+\??/,"")),h=y.get("token");h&&(p.token=h);var T=y.get("spa");p.spa=null===T\|\|"true"===T}}p&&"multi"!==p.load&&(p.load="single"),window.__cfBeacon=p}if(s&&p&&p.token){var w,S,b=!1;document.addEventList
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 2e 74 69 6d 69 6e 67 73 56 32 3d 7b 7d 2c 64 2e 76 65 72 73 69 6f 6e 73 2e 74 69 6d 69 6e 67 73 3d 32 2c 64 2e 64 74 3d 6d 5b 30 5d 2e 64 65 6c 69 76 65 72 79 54 79 70 65 2c 64 65 6c 65 74 65 20 64 2e 74 69 6d 69 6e 67 73 2c 74 28 6d 5b 30 5d 2c 64 2e 74 69 6d 69 6e 67 73 56 32 29 29 7d 31 3d 3d 3d 64 2e 76 65 72 73 69 6f 6e 73 2e 74 69 6d 69 6e 67 73 26 26 74 28 63 2c 64 2e 74 69 6d 69 6e 67 73 29 2c 74 28 75 2c 64 2e 6d 65 6d 6f 72 79 29 7d 65 6c 73 65 20 4f 28 64 29 3b 72 65 74 75 72 6e 20 64 2e 66 69 72 73 74 50 61 69 6e 74 3d 6b 28 22 66 69 72 73 74 2d 70 61 69 6e 74 22 29 2c 64 2e 66 69 72 73 74 43 6f 6e 74 65 6e 74 66 75 6c 50 61 69 6e 74 3d 6b 28 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 29 2c 70 26 26 28 70 2e 69 63 Data Ascii: .timingsV2={},d.versions.timings=2,d.dt=m[0].deliveryType,delete d.timings,t(m[0],d.timingsV2))}1===d.versions.timings&&t(c,d.timings),t(u,d.memory)}else O(d);return d.firstPaint=k("first-paint"),d.firstContentfulPaint=k("first-contentful-paint"),p&&(p.ic
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 65 72 65 64 3a 21 30 7d 7d 3b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 3f 52 28 29 3a 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 52 29 7d 29 29 3b 76 61 72 20 41 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4c 26 26 30 3d 3d 3d 76 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 64 3d 3d 3d 6c 7d 29 29 2e 6c 65 6e 67 74 68 7d 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 2e 70 75 73 68 28 7b 69 64 3a 6c 2c 75 72 6c 3a 65 2c 74 73 3a 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 Data Ascii: ered:!0}};"complete"===window.document.readyState?R():window.addEventListener("load",(function(){window.setTimeout(R)}));var A=function(){return L&&0===v.filter((function(e){return e.id===l})).length},_=function(e){v.push({id:l,url:e,ts:(new Date).getTime
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 72 63 65 4c 6f 61 64 54 69 6d 65 2c 45 2e 6c 63 70 2e 65 72 64 3d 63 2e 65 6c 65 6d 65 6e 74 52 65 6e 64 65 72 44 65 6c 61 79 2c 45 2e 6c 63 70 2e 69 74 3d 6e 75 6c 6c 3d 3d 3d 28 69 3d 63 2e 6c 63 70 52 65 73 6f 75 72 63 65 45 6e 74 72 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 69 6e 69 74 69 61 74 6f 72 54 79 70 65 2c 45 2e 6c 63 70 2e 66 70 3d 6e 75 6c 6c 3d 3d 3d 28 61 3d 6e 75 6c 6c 3d 3d 3d 28 6f 3d 63 2e 6c 63 70 45 6e 74 72 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 65 6c 65 6d 65 6e 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 66 65 74 63 68 70 72 69 6f 72 69 74 79 22 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 49 4e 50 22 Data Ascii: rceLoadTime,E.lcp.erd=c.elementRenderDelay,E.lcp.it=null===(i=c.lcpResourceEntry)\|\|void 0===i?void 0:i.initiatorType,E.lcp.fp=null===(a=null===(o=c.lcpEntry)\|\|void 0===o?void 0:o.element)\|\|void 0===a?void 0:a.getAttribute("fetchpriority"));break;case"INP"
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 64 65 64 42 6f 64 79 53 69 7a 65 26 26 28 72 2e 64 65 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 3d 6e 5b 30 5d 2e 64 65 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 29 2c 65 2e 64 74 3d 6e 5b 30 5d 2e 64 65 6c 69 76 65 72 79 54 79 70 65 29 2c 74 28 72 2c 65 2e 74 69 6d 69 6e 67 73 56 32 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 65 29 7b 76 61 72 20 74 3b 69 66 28 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 3d 3d 3d 65 26 26 45 2e 66 63 70 26 26 45 2e 66 63 70 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 45 2e 66 63 70 2e 76 61 6c 75 65 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 3d 3d 3d 28 74 3d 73 2e 67 65 74 45 6e 74 72 69 Data Ascii: dedBodySize&&(r.decodedBodySize=n[0].decodedBodySize),e.dt=n[0].deliveryType),t(r,e.timingsV2)}}function k(e){var t;if("first-contentful-paint"===e&&E.fcp&&E.fcp.value)return E.fcp.value;if("function"==typeof s.getEntriesByType){var n=null===(t=s.getEntri
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 76 65 6e 74 54 79 70 65 3d 7b 7d 29 29 5b 72 2e 4c 6f 61 64 3d 31 5d 3d 22 4c 6f 61 64 22 2c 72 5b 72 2e 41 64 64 69 74 69 6f 6e 61 6c 3d 32 5d 3d 22 41 64 64 69 74 69 6f 6e 61 6c 22 2c 72 5b 72 2e 57 65 62 56 69 74 61 6c 73 56 32 3d 33 5d 3d 22 57 65 62 56 69 74 61 6c 73 56 32 22 2c 28 6e 3d 74 2e 46 65 74 63 68 50 72 69 6f 72 69 74 79 7c 7c 28 74 2e 46 65 74 63 68 50 72 69 6f 72 69 74 79 3d 7b 7d 29 29 2e 48 69 67 68 3d 22 68 69 67 68 22 2c 6e 2e 4c 6f 77 3d 22 6c 6f 77 22 2c 6e 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 2c 31 30 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 Data Ascii: ventType={}))[r.Load=1]="Load",r[r.Additional=2]="Additional",r[r.WebVitalsV2=3]="WebVitalsV2",(n=t.FetchPriority\|\|(t.FetchPriority={})).High="high",n.Low="low",n.Auto="auto"},104:function(e,t){!function(e){"use strict";var t,n,r,i,o,a=function(){return w
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 30 3f 72 3d 22 70 72 65 72 65 6e 64 65 72 22 3a 64 6f 63 75 6d 65 6e 74 2e 77 61 73 44 69 73 63 61 72 64 65 64 3f 72 3d 22 72 65 73 74 6f 72 65 22 3a 6e 2e 74 79 70 65 26 26 28 72 3d 6e 2e 74 79 70 65 2e 72 65 70 6c 61 63 65 28 2f 5f 2f 67 2c 22 2d 22 29 29 29 2c 7b 6e 61 6d 65 3a 65 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 3d 3d 3d 74 3f 2d 31 3a 74 2c 72 61 74 69 6e 67 3a 22 67 6f 6f 64 22 2c 64 65 6c 74 61 3a 30 2c 65 6e 74 72 69 65 73 3a 5b 5d 2c 69 64 3a 22 76 33 2d 22 2e 63 6f 6e 63 61 74 28 44 61 74 65 2e 6e 6f 77 28 29 2c 22 2d 22 29 2e 63 6f 6e 63 61 74 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 38 39 39 39 39 39 39 39 39 39 39 39 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 2b 31 65 31 32 29 2c 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 3a 72 7d 7d 2c Data Ascii: 0?r="prerender":document.wasDiscarded?r="restore":n.type&&(r=n.type.replace(/_/g,"-"))),{name:e,value:void 0===t?-1:t,rating:"good",delta:0,entries:[],id:"v3-".concat(Date.now(),"-").concat(Math.floor(8999999999999*Math.random())+1e12),navigationType:r}},
2025-03-21 20:29:13 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 62 2c 21 30 29 2c 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 72 65 72 65 6e 64 65 72 69 6e 67 63 68 61 6e 67 65 22 2c 62 2c 21 30 29 7d 2c 43 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 3c 30 26 26 28 77 3d 53 28 29 2c 45 28 29 2c 6c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 3d 53 28 29 2c 45 28 29 7d 29 2c 30 29 7d 29 29 29 2c 7b 67 65 74 20 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 28 29 7b 72 65 74 75 72 6e 20 77 7d 7d 7d 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 64 6f 63 75 6d 65 6e 74 2e 70 Data Ascii: function(){removeEventListener("visibilitychange",b,!0),removeEventListener("prerenderingchange",b,!0)},C=function(){return w<0&&(w=S(),E(),l((function(){setTimeout((function(){w=S(),E()}),0)}))),{get firstHiddenTime(){return w}}},P=function(e){document.p

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:14 UTC	1394	OUT	GET /api/vertical/QL_LRE_LP?optimizelyVisitorId=&sourceId=affl_everflow_ql-lre_165_921&moid=322646 HTTP/1.1 Host: refinance.quickenloans.com Connection: keep-alive x-datadog-sampling-priority: 1 x-datadog-parent-id: 7974559808532719458 sec-ch-ua-platform: "Windows" sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 x-datadog-trace-id: 7105523323750656541 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" Accept: application/json, text/plain, / x-datadog-origin: rum x-datadog-sampled: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=b50atuKg7IfypPtBtfyfKPNOc6TeZ_xV0E5ZPPl2WC8-1742588949-1.0.1.1-yPXlY4a_CqVqIKvwZAWsbvE3Bph4rbl_4eqqWLRJ9DlE6nyHODQGgHz8IBf1_RjGzumSs9aclYF8inLs0fFp9yPSJgYDMgpHQ4pawWv4CD8; _lre_new=true; visitorId=c5e9b2ed-9fac-4a12-8925-533aeb0fd473; _dd_s=rum=1&id=29011fb7-7a9f-409f-a98b-391e791f5e2f&created=1742588953236&expire=1742589853236
2025-03-21 20:29:14 UTC	1297	IN	HTTP/1.1 403 Forbidden Date: Fri, 21 Mar 2025 20:29:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8672 Connection: close accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy: same-origin server-timing: chlray;desc="92403345ad0e5017" x-content-options: nosniff
2025-03-21 20:29:14 UTC	648	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 71 68 5a 61 6f 64 64 52 61 2f 75 6a 6d 6c 56 62 74 43 33 43 57 70 52 55 70 38 68 4a 42 73 76 4d 75 36 4b 42 6a 38 72 71 61 37 76 31 33 32 46 79 52 62 53 2f 78 6d 37 32 4a 38 41 63 37 32 52 67 36 5a 52 6c 77 66 6d 46 38 2f 79 56 6a 57 57 49 49 7a 64 4a 36 64 35 47 38 57 72 64 2f 46 65 6d 32 66 50 35 48 61 58 4a 61 56 53 4e 54 55 35 71 41 42 4d 6c 67 4e 54 64 32 74 4d 49 34 71 53 45 70 39 51 37 4b 76 2f 43 66 43 4b 79 63 53 37 65 6f 4a 2b 36 54 41 3d 3d 24 73 68 33 36 46 31 35 37 78 45 77 39 4e 52 63 63 32 75 42 6d 69 51 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: qhZaoddRa/ujmlVbtC3CWpRUp8hJBsvMu6KBj8rqa7v132FyRbS/xm72J8Ac72Rg6ZRlwfmF8/yVjWWIIzdJ6d5G8Wrd/Fem2fP5HaXJaVSNTU5qABMlgNTd2tMI4qSEp9Q7Kv/CfCKycS7eoJ+6TA==$sh36F157xEw9NRcc2uBmiQ==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2025-03-21 20:29:14 UTC	793	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewp
2025-03-21 20:29:14 UTC	1369	IN	Data Raw: 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 32 35 72 65 6d 7d 40 6d 65 64 69 61 20 28 77 69 64 74 68 20 3c 3d 20 37 32 30 70 78 29 7b 2e 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 72 65 6d 7d 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 64 70 5a 48 52 6f 50 53 49 7a Data Ascii: h2{font-size:1.5rem;font-weight:500;line-height:2.25rem}@media (width <= 720px){.h2{font-size:1.25rem;line-height:1.5rem}}#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIz
2025-03-21 20:29:14 UTC	1369	IN	Data Raw: 31 2d 65 79 6f 4b 7a 68 52 77 4a 67 52 4f 31 30 58 47 43 5a 79 79 5a 56 4b 74 4d 38 64 4f 58 31 5f 79 74 4f 63 4c 53 36 67 65 68 66 72 73 4d 51 6e 73 65 79 77 49 47 66 48 7a 34 72 33 5f 39 4d 72 53 27 2c 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 61 70 69 5c 2f 76 65 72 74 69 63 61 6c 5c 2f 51 4c 5f 4c 52 45 5f 4c 50 3f 6f 70 74 69 6d 69 7a 65 6c 79 56 69 73 69 74 6f 72 49 64 3d 26 73 6f 75 72 63 65 49 64 3d 61 66 66 6c 5f 65 76 65 72 66 6c 6f 77 5f 71 6c 2d 6c 72 65 5f 31 36 35 5f 39 32 31 26 6d 6f 69 64 3d 33 32 32 36 34 36 26 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 76 54 72 63 67 70 78 7a 6e 4c 47 6a 73 66 53 39 52 6f 37 63 39 4f 49 41 36 2e 75 63 6e 5a 48 4e 44 33 34 2e 55 4c 45 43 59 53 38 2d 31 37 34 32 35 38 38 39 35 34 2d 31 2e 30 2e 31 2e 31 2d 76 6f 77 42 Data Ascii: 1-eyoKzhRwJgRO10XGCZyyZVKtM8dOX1_ytOcLS6gehfrsMQnseywIGfHz4r3_9MrS',cUPMDTk: "\/api\/vertical\/QL_LRE_LP?optimizelyVisitorId=&sourceId=affl_everflow_ql-lre_165_921&moid=322646&__cf_chl_tk=vTrcgpxznLGjsfS9Ro7c9OIA6.ucnZHND34.ULECYS8-1742588954-1.0.1.1-vowB
2025-03-21 20:29:14 UTC	1369	IN	Data Raw: 79 6c 4e 51 45 6e 78 6c 35 74 73 4c 57 4a 55 52 68 38 37 39 68 69 56 44 65 64 53 43 77 4b 4f 44 46 49 35 31 77 79 4b 46 66 39 50 42 4b 6f 62 74 45 74 78 4d 42 39 51 50 6a 77 45 6e 76 34 6e 51 54 58 4e 51 76 2e 7a 53 35 4a 51 5a 72 78 46 6b 79 77 45 78 6a 63 51 74 43 51 64 4f 56 72 37 45 59 4c 69 45 58 73 46 35 63 48 61 6a 64 78 42 4d 5f 54 37 6c 79 73 58 79 4d 62 41 39 76 62 31 5a 55 4c 38 6a 39 68 4c 69 32 55 71 46 61 6c 49 33 46 47 56 46 55 37 67 45 66 31 50 6b 63 78 68 41 37 61 61 42 49 35 57 36 6b 6a 32 44 38 78 75 79 47 4c 34 6d 51 42 41 44 39 6d 4d 4d 6b 73 46 62 59 47 2e 77 73 2e 6b 30 75 34 48 6b 6c 4d 76 6e 32 53 4d 64 62 4c 31 33 57 76 46 64 33 33 6f 78 48 36 6d 44 56 4d 53 4e 49 4d 6a 64 65 49 6c 6c 31 50 4d 47 39 31 55 54 55 70 49 54 4b 78 79 Data Ascii: ylNQEnxl5tsLWJURh879hiVDedSCwKODFI51wyKFf9PBKobtEtxMB9QPjwEnv4nQTXNQv.zS5JQZrxFkywExjcQtCQdOVr7EYLiEXsF5cHajdxBM_T7lysXyMbA9vb1ZUL8j9hLi2UqFalI3FGVFU7gEf1PkcxhA7aaBI5W6kj2D8xuyGL4mQBAD9mMMksFbYG.ws.k0u4HklMvn2SMdbL13WvFd33oxH6mDVMSNIMjdeIll1PMG91UTUpITKxy
2025-03-21 20:29:14 UTC	1369	IN	Data Raw: 31 57 6e 62 58 2e 6d 61 74 35 35 46 62 6e 6e 61 45 4d 65 6e 68 73 58 6d 6e 55 63 48 56 68 50 4a 4a 53 72 66 76 42 4f 7a 51 30 6b 4b 5f 49 32 74 46 54 39 73 4f 38 6a 4e 56 33 66 41 6e 53 44 30 34 79 69 74 41 67 44 6d 44 68 68 37 2e 56 76 4c 4b 46 5a 32 66 4e 4d 44 35 5f 50 34 4e 73 5a 4c 57 51 54 46 39 75 59 42 6a 61 59 59 69 39 31 6b 6f 7a 46 49 75 6d 68 4b 4a 53 77 68 32 52 4b 64 45 61 56 45 69 46 58 38 32 74 66 62 5a 77 77 4e 57 30 39 6e 52 41 57 76 43 72 5f 6e 7a 66 2e 4a 42 50 75 4d 68 77 44 5a 41 2e 76 34 77 6f 4c 65 2e 34 57 6d 75 59 46 4d 4e 54 50 71 77 79 38 6f 61 4d 36 59 34 41 65 32 52 7a 66 66 35 31 62 70 70 6a 61 59 58 54 78 34 53 35 51 63 4f 7a 32 78 35 2e 42 73 64 47 4c 67 36 6d 4f 6b 55 71 72 39 35 65 51 63 56 58 72 46 51 79 5a 34 66 34 33 Data Ascii: 1WnbX.mat55FbnnaEMenhsXmnUcHVhPJJSrfvBOzQ0kK_I2tFT9sO8jNV3fAnSD04yitAgDmDhh7.VvLKFZ2fNMD5_P4NsZLWQTF9uYBjaYYi91kozFIumhKJSwh2RKdEaVEiFX82tfbZwwNW09nRAWvCr_nzf.JBPuMhwDZA.v4woLe.4WmuYFMNTPqwy8oaM6Y4Ae2Rzff51bppjaYXTx4S5QcOz2x5.BsdGLg6mOkUqr95eQcVXrFQyZ4f43
2025-03-21 20:29:14 UTC	1369	IN	Data Raw: 75 6e 4a 69 67 65 69 42 6b 36 6a 74 65 57 4d 50 68 62 37 41 79 66 6d 33 75 53 36 4c 4e 38 75 5a 6c 72 50 44 55 47 4b 48 75 52 30 44 38 74 69 4e 79 54 31 39 47 75 70 56 5f 32 34 36 6b 6b 74 68 4a 36 30 5a 66 36 64 63 58 76 30 41 4a 63 51 30 77 5f 65 70 32 54 4c 41 4d 61 59 71 55 4d 52 51 68 4e 5a 6b 59 4b 52 43 59 72 62 66 75 75 5a 69 63 62 45 56 67 39 61 73 64 79 67 46 61 6f 6e 61 4c 54 66 43 50 6c 70 51 4e 4a 41 4d 4a 70 42 57 55 54 68 55 6b 51 63 6f 49 68 4e 77 6d 4a 64 4b 7a 6e 77 37 50 45 79 39 56 44 47 55 6e 34 58 33 79 6e 33 34 37 51 53 4d 66 6b 4f 7a 72 7a 65 77 6c 70 43 41 49 76 68 51 33 7a 76 62 35 48 2e 5a 62 38 78 49 73 33 6b 4c 64 62 48 4e 47 63 4f 64 4a 69 31 65 30 75 34 53 67 61 50 41 6a 63 2e 73 7a 71 37 57 6e 33 65 65 64 48 77 45 79 79 2e Data Ascii: unJigeiBk6jteWMPhb7Ayfm3uS6LN8uZlrPDUGKHuR0D8tiNyT19GupV_246kkthJ60Zf6dcXv0AJcQ0w_ep2TLAMaYqUMRQhNZkYKRCYrbfuuZicbEVg9asdygFaonaLTfCPlpQNJAMJpBWUThUkQcoIhNwmJdKznw7PEy9VDGUn4X3yn347QSMfkOzrzewlpCAIvhQ3zvb5H.Zb8xIs3kLdbHNGcOdJi1e0u4SgaPAjc.szq7Wn3eedHwEyy.
2025-03-21 20:29:14 UTC	1034	IN	Data Raw: 69 44 63 73 63 5f 36 65 57 4b 42 35 71 4a 75 61 76 68 49 41 4d 75 72 31 78 37 6b 67 22 7d 3b 76 61 72 20 63 70 6f 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 63 70 6f 2e 73 72 63 20 3d 20 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 68 2f 62 2f 6f 72 63 68 65 73 74 72 61 74 65 2f 63 68 6c 5f 70 61 67 65 2f 76 31 3f 72 61 79 3d 39 32 34 30 33 33 34 35 61 64 30 65 35 30 31 37 27 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 63 4f 67 55 48 61 73 68 20 3d 20 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 20 3d 3d 3d 20 27 27 20 26 26 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 23 27 29 20 21 3d 3d 20 2d 31 20 3f 20 27 23 Data Ascii: iDcsc_6eWKB5qJuavhIAMur1x7kg"};var cpo = document.createElement('script');cpo.src = '/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=92403345ad0e5017';window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:14 UTC	576	OUT	GET /b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js HTTP/1.1 Host: assets.adobedtm.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:14 UTC	465	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript ETag: "b31a1f9e9f88d2133e2b3a9abeeddcd7:1696276509.604687" Last-Modified: Mon, 02 Oct 2023 19:55:09 GMT Server: AkamaiNetStorage Cache-Control: max-age=3600 Expires: Fri, 21 Mar 2025 21:29:14 GMT Date: Fri, 21 Mar 2025 20:29:14 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Timing-Allow-Origin: *
2025-03-21 20:29:14 UTC	15919	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2f 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 73 65 65 20 60 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 61 64 6f 62 65 64 74 6d 2e 63 6f 6d 2f 62 31 34 36 33 36 62 31 30 38 38 38 2f 61 33 65 63 37 65 66 31 66 33 36 36 2f 6c 61 75 6e 63 68 2d 30 39 39 39 38 32 61 37 34 36 63 63 2e 6a 73 60 2e 0a 77 69 6e 64 6f 77 2e 5f 73 61 74 65 6c 6c 69 74 65 3d 77 69 6e 64 6f 77 2e 5f 73 61 74 65 6c 6c 69 74 65 7c 7c 7b 7d 2c 77 69 6e 64 6f 77 2e 5f 73 61 74 65 6c 6c 69 74 65 2e 63 6f 6e 74 61 69 6e 65 72 3d 7b 62 75 69 6c 64 49 6e 66 6f 3a 7b 6d 69 6e 69 66 69 65 64 3a 21 30 2c 62 75 69 6c 64 44 61 74 65 3a 22 32 30 32 33 2d 31 30 2d 30 32 54 31 39 3a 35 35 3a 30 32 5a 22 2c 74 75 72 62 69 6e 65 42 Data Ascii: 00006000// For license information, see `https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.js`.window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2023-10-02T19:55:02Z",turbineB
2025-03-21 20:29:14 UTC	8669	IN	Data Raw: 2c 74 2c 6e 2c 72 2c 6f 2c 69 2c 61 29 7b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 44 61 74 61 56 69 65 77 5d 22 3a 69 66 28 65 2e 62 79 74 65 4c 65 6e 67 74 68 21 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 7c 7c 65 2e 62 79 74 65 4f 66 66 73 65 74 21 3d 74 2e 62 79 74 65 4f 66 66 73 65 74 29 62 72 65 61 6b 3b 65 3d 65 2e 62 75 66 66 65 72 2c 74 3d 74 2e 62 75 66 66 65 72 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d 22 3a 69 66 28 65 2e 62 79 74 65 4c 65 6e 67 74 68 21 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 7c 7c 21 69 28 6e 65 77 20 4f 74 28 65 29 2c 6e 65 77 20 4f 74 28 74 29 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 21 30 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 42 6f 6f 6c 65 61 6e 5d 22 3a 63 Data Ascii: ,t,n,r,o,i,a){switch(n){case"[object DataView]":if(e.byteLength!=t.byteLength\|\|e.byteOffset!=t.byteOffset)break;e=e.buffer,t=t.buffer;case"[object ArrayBuffer]":if(e.byteLength!=t.byteLength\|\|!i(new Ot(e),new Ot(t)))break;return!0;case"[object Boolean]":c
2025-03-21 20:29:14 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 29 2c 72 3d 5b 5d 3b 66 6f 72 28 74 20 69 6e 20 65 29 28 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 21 3d 74 7c 7c 21 6e 26 26 62 74 2e 63 61 6c 6c 28 65 2c 74 29 29 26 26 72 2e 70 75 73 68 28 74 29 3b 65 3d 72 7d 65 6c 73 65 7b 69 66 28 74 3d 5b 5d 2c 6e 75 6c 6c 21 3d 65 29 66 6f 72 28 6e 20 69 6e 20 4f 62 6a 65 63 74 28 65 29 29 74 2e 70 75 73 68 28 6e 29 3b 65 3d 74 7d 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 78 65 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 5b 5d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6f 28 74 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 5b 74 5d 7d 29 29 7d 28 65 2c 54 65 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 65 28 65 29 7b Data Ascii: 00006000e),r=[];for(t in e)("constructor"!=t\|\|!n&&bt.call(e,t))&&r.push(t);e=r}else{if(t=[],null!=e)for(n in Object(e))t.push(n);e=t}return e}function xe(e){return null==e?[]:function(e,t){return o(t,(function(t){return e[t]}))}(e,Te(e))}function je(e){
2025-03-21 20:29:14 UTC	8204	IN	Data Raw: 43 48 41 4e 47 45 26 26 28 61 3d 6e 28 65 2c 74 29 29 29 2c 61 7d 7d 2c 7b 22 2e 2e 2f 2e 2e 2f 63 75 73 74 6f 6d 2d 6c 6f 64 61 73 68 22 3a 31 2c 22 2e 2e 2f 63 6f 6e 73 74 61 6e 74 73 22 3a 32 2c 22 2e 2f 61 6e 63 65 73 74 6f 72 52 65 6d 6f 76 65 64 22 3a 39 7d 5d 2c 31 34 3a 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 76 65 72 73 69 6f 6e 3a 22 32 2e 30 2e 32 22 7d 7d 2c 7b 7d 5d 7d 2c 7b 7d 2c 5b 34 5d 29 7d 7d 7d 2c 22 67 63 6f 65 2d 61 64 6f 62 65 2d 63 6c 69 65 6e 74 2d 64 61 74 61 2d 6c 61 79 65 72 2f 73 72 63 2f 6c 69 62 2f 75 74 69 6c 2f 67 65 74 44 61 74 61 4c 61 79 65 72 2e 6a 73 22 3a 7b 73 63 72 69 70 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 65 Data Ascii: CHANGE&&(a=n(e,t))),a}},{"../../custom-lodash":1,"../constants":2,"./ancestorRemoved":9}],14:[function(e,t){t.exports={version:"2.0.2"}},{}]},{},[4])}}},"gcoe-adobe-client-data-layer/src/lib/util/getDataLayer.js":{script:function(e,t,n,r){"use strict";e.e
2025-03-21 20:29:14 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 6b 7d 69 66 28 74 29 7b 76 61 72 20 6e 3d 7b 7d 3b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 6f 2c 69 29 7b 76 61 72 20 61 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 22 22 2c 73 3d 7b 5f 5f 74 63 66 61 70 69 43 61 6c 6c 3a 7b 63 6f 6d 6d 61 6e 64 3a 65 2c 70 61 72 61 6d 65 74 65 72 3a 69 2c 76 65 72 73 69 6f 6e 3a 72 2c 63 61 6c 6c 49 64 3a 61 7d 7d 3b 6e 5b 61 5d 3d 6f 2c 74 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 73 2c 22 2a 22 29 7d 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 64 61 74 61 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 Data Ascii: 00004000ak}if(t){var n={};return window.__tcfapi=function(e,r,o,i){var a=Math.random()+"",s={__tcfapiCall:{command:e,parameter:i,version:r,callId:a}};n[a]=o,t.postMessage(s,"*")},window.addEventListener("message",(function(e){var t=e.data;if("string"==t
2025-03-21 20:29:14 UTC	12	IN	Data Raw: 6f 2e 6a 73 6f 6e 57 61 69 74 0d 0a Data Ascii: o.jsonWait
2025-03-21 20:29:14 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 6e 67 2e 70 75 73 68 28 74 29 2c 6f 2e 70 72 6f 63 65 73 73 53 79 6e 63 4f 6e 50 61 67 65 28 74 29 7d 76 61 72 20 72 2c 6f 3d 74 68 69 73 0a 3b 69 66 28 74 3d 3d 3d 4f 62 6a 65 63 74 28 74 29 26 26 74 2e 69 62 73 29 69 66 28 72 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 2e 69 62 73 7c 7c 5b 5d 29 2c 74 68 69 73 2e 6a 73 6f 6e 46 6f 72 43 6f 6d 70 61 72 69 73 6f 6e 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 69 2c 61 2c 73 2c 63 3d 21 31 3b 66 6f 72 28 69 3d 30 2c 61 3d 74 68 69 73 2e 6a 73 6f 6e 46 6f 72 43 6f 6d 70 61 72 69 73 6f 6e 2e 6c 65 6e 67 74 68 3b 69 3c 61 3b 69 2b 2b 29 69 66 28 73 3d 74 68 69 73 2e 6a 73 6f 6e 46 6f 72 43 6f 6d 70 61 72 69 73 6f 6e 5b 69 5d 2c 72 3d 3d 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 Data Ascii: 00004000ing.push(t),o.processSyncOnPage(t)}var r,o=this;if(t===Object(t)&&t.ibs)if(r=JSON.stringify(t.ibs\|\|[]),this.jsonForComparison.length){var i,a,s,c=!1;for(i=0,a=this.jsonForComparison.length;i<a;i++)if(s=this.jsonForComparison[i],r===JSON.stringi
2025-03-21 20:29:14 UTC	12	IN	Data Raw: 6f 70 74 49 6e 2e 6f 66 66 28 0d 0a Data Ascii: optIn.off(
2025-03-21 20:29:14 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 22 63 6f 6d 70 6c 65 74 65 22 2c 68 29 7d 69 66 28 21 72 7c 7c 72 2e 73 70 6c 69 74 28 22 22 29 2e 72 65 76 65 72 73 65 28 29 2e 6a 6f 69 6e 28 22 22 29 21 3d 3d 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 50 6c 65 61 73 65 20 75 73 65 20 60 56 69 73 69 74 6f 72 2e 67 65 74 49 6e 73 74 61 6e 63 65 60 20 74 6f 20 69 6e 73 74 61 6e 74 69 61 74 65 20 56 69 73 69 74 6f 72 2e 22 29 3b 76 61 72 20 62 3d 74 68 69 73 2c 43 3d 77 69 6e 64 6f 77 2e 61 64 6f 62 65 2c 53 3d 22 22 2c 77 3d 30 2c 49 3d 21 31 2c 45 3d 21 31 3b 62 2e 76 65 72 73 69 6f 6e 3d 22 35 2e 35 2e 30 22 3b 76 61 72 20 4f 3d 79 2c 44 3d 4f 2e 56 69 73 69 74 6f 72 3b 44 2e 76 65 72 73 69 6f 6e 3d 62 2e 76 65 72 73 69 6f 6e 2c 44 2e 41 75 74 68 53 74 61 74 Data Ascii: 00004000"complete",h)}if(!r\|\|r.split("").reverse().join("")!==t)throw new Error("Please use `Visitor.getInstance` to instantiate Visitor.");var b=this,C=window.adobe,S="",w=0,I=!1,E=!1;b.version="5.5.0";var O=y,D=O.Visitor;D.version=b.version,D.AuthStat
2025-03-21 20:29:14 UTC	12	IN	Data Raw: 7d 0a 69 66 28 62 2e 69 64 53 0d 0a Data Ascii: }if(b.idS

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:14 UTC	558	OUT	GET /us1/v5/datadog-logs.js HTTP/1.1 Host: www.datadoghq-browser-agent.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:14 UTC	559	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 57534 Connection: close Date: Fri, 21 Mar 2025 20:29:15 GMT Last-Modified: Fri, 14 Feb 2025 13:31:28 GMT ETag: "e229238b65ffda55a248392b78704816" x-amz-server-side-encryption: AES256 Cache-Control: max-age=14400, s-maxage=60 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P4 X-Amz-Cf-Id: LyWrbFL9tr7JCOf5_3lFshSk9-87QEFy550lYy5AMBorAEam66MXGw== Timing-Allow-Origin: *
2025-03-21 20:29:14 UTC	14588	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 6c 6f 67 3a 22 6c 6f 67 22 2c 64 65 62 75 67 3a 22 64 65 62 75 67 22 2c 69 6e 66 6f 3a 22 69 6e 66 6f 22 2c 77 61 72 6e 3a 22 77 61 72 6e 22 2c 65 72 72 6f 72 3a 22 65 72 72 6f 72 22 7d 2c 74 3d 63 6f 6e 73 6f 6c 65 2c 6e 3d 7b 7d 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 5b 65 5d 3d 74 5b 65 5d 7d 29 29 3b 76 61 72 20 72 3d 22 44 61 74 61 64 6f 67 20 42 72 6f 77 73 65 72 20 53 44 4b 3a 22 2c 6f 3d 7b 64 65 62 75 67 3a 6e 2e 64 65 62 75 67 2e 62 69 6e 64 28 74 2c 72 29 2c 6c 6f 67 3a 6e 2e 6c 6f 67 2e 62 69 6e 64 28 74 2c 72 29 2c 69 6e 66 6f 3a 6e 2e 69 6e 66 6f 2e 62 69 6e 64 28 74 2c 72 Data Ascii: !function(){"use strict";var e={log:"log",debug:"debug",info:"info",warn:"warn",error:"error"},t=console,n={};Object.keys(e).forEach((function(e){n[e]=t[e]}));var r="Datadog Browser SDK:",o={debug:n.debug.bind(t,r),log:n.log.bind(t,r),info:n.info.bind(t,r
2025-03-21 20:29:14 UTC	2363	IN	Data Raw: 22 2c 22 3c 61 6e 6f 6e 79 6d 6f 75 73 3e 22 5d 2c 58 65 3d 5b 22 64 64 6f 67 2d 67 6f 76 2e 63 6f 6d 22 5d 2c 5a 65 3d 57 65 28 29 2c 51 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5a 65 2e 61 64 64 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 51 65 28 65 29 7d 29 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 65 74 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 6f 3d 6e 65 77 20 57 2c 69 3d 6e 65 77 20 53 65 74 2c 61 3d 21 79 28 58 65 2c 74 2e 73 69 74 65 29 26 26 48 65 28 74 2e 74 65 6c 65 6d 65 74 72 79 53 61 6d 70 6c 65 52 61 74 65 29 2c 73 3d 28 28 6e 3d 7b 7d 29 5b 56 65 5d 3d 61 2c 6e 5b 24 65 5d 3d 61 26 26 48 65 28 74 2e 74 65 6c 65 6d 65 74 72 79 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 53 61 6d 70 6c 65 52 61 74 65 29 2c 6e 5b 4b 65 5d 3d 61 26 26 Data Ascii: ","<anonymous>"],Xe=["ddog-gov.com"],Ze=We(),Qe=function(e){Ze.add((function(){return Qe(e)}))};function et(e,t){var n,r,o=new W,i=new Set,a=!y(Xe,t.site)&&He(t.telemetrySampleRate),s=((n={})[Ve]=a,n[$e]=a&&He(t.telemetryConfigurationSampleRate),n[Ke]=a&&
2025-03-21 20:29:14 UTC	16384	IN	Data Raw: 3a 69 3e 33 3f 6f 28 74 2c 6e 2c 61 29 3a 6f 28 74 2c 6e 29 29 7c 7c 61 29 3b 72 65 74 75 72 6e 20 69 3e 33 26 26 61 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 6e 2c 61 29 2c 61 7d 2c 68 74 3d 22 63 6f 6e 73 6f 6c 65 22 2c 62 74 3d 22 68 74 74 70 22 2c 77 74 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 70 74 29 2c 53 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6e 2c 72 2c 6f 2c 69 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 62 74 29 2c 76 6f 69 64 20 30 3d 3d 3d 6f 26 26 28 6f 3d 70 74 2e 64 65 62 75 67 29 2c 76 6f 69 64 20 30 3d 3d 3d 69 26 26 28 69 3d 7b 7d 29 2c 74 68 69 73 2e 68 61 6e 64 6c 65 4c 6f 67 53 74 72 61 74 65 67 79 3d 65 2c 74 68 69 73 2e 68 61 6e 64 6c 65 72 54 79 Data Ascii: :i>3?o(t,n,a):o(t,n))\|\|a);return i>3&&a&&Object.defineProperty(t,n,a),a},ht="console",bt="http",wt=Object.keys(pt),St=function(){function e(e,t,n,r,o,i){void 0===r&&(r=bt),void 0===o&&(o=pt.debug),void 0===i&&(i={}),this.handleLogStrategy=e,this.handlerTy
2025-03-21 20:29:14 UTC	16384	IN	Data Raw: 2c 6e 2c 72 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 3f 67 65 28 7b 6e 61 6d 65 3a 65 2c 6d 65 73 73 61 67 65 3a 74 2c 73 74 61 63 6b 3a 5b 7b 66 75 6e 63 3a 22 3f 22 2c 75 72 6c 3a 6e 2c 6c 69 6e 65 3a 6e 75 6c 6c 21 3d 72 3f 72 3a 76 6f 69 64 20 30 2c 63 6f 6c 75 6d 6e 3a 6e 75 6c 6c 21 3d 6f 3f 6f 3a 76 6f 69 64 20 30 7d 5d 7d 29 3a 76 6f 69 64 20 30 7d 66 75 6e 63 74 69 6f 6e 20 52 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 5b 5d 3a 22 61 6c 6c 22 3d 3d 3d 65 7c 7c 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 26 26 65 2e 65 76 65 72 79 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 79 28 74 2c 65 29 7d 29 29 3f 22 61 6c 6c 22 3d 3d 3d 65 3f 74 3a 28 72 3d 65 2c 69 3d 6e 65 77 20 53 65 74 2c 72 2e 66 Data Ascii: ,n,r,o){return n?ge({name:e,message:t,stack:[{func:"?",url:n,line:null!=r?r:void 0,column:null!=o?o:void 0}]}):void 0}function Rn(e,t,n){return void 0===e?[]:"all"===e\|\|Array.isArray(e)&&e.every((function(e){return y(t,e)}))?"all"===e?t:(r=e,i=new Set,r.f
2025-03-21 20:29:14 UTC	7815	IN	Data Raw: 75 28 65 2c 74 29 2c 63 3d 6e 26 26 75 28 65 2c 6e 29 3b 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 2e 65 6e 64 70 6f 69 6e 74 2c 73 3d 74 2e 65 6e 63 6f 64 65 72 3b 72 65 74 75 72 6e 20 61 28 7b 65 6e 63 6f 64 65 72 3a 73 2c 72 65 71 75 65 73 74 3a 62 72 28 6e 2c 65 2e 62 61 74 63 68 42 79 74 65 73 4c 69 6d 69 74 2c 72 29 2c 66 6c 75 73 68 43 6f 6e 74 72 6f 6c 6c 65 72 3a 6b 72 28 7b 6d 65 73 73 61 67 65 73 4c 69 6d 69 74 3a 65 2e 62 61 74 63 68 4d 65 73 73 61 67 65 73 4c 69 6d 69 74 2c 62 79 74 65 73 4c 69 6d 69 74 3a 65 2e 62 61 74 63 68 42 79 74 65 73 4c 69 6d 69 74 2c 64 75 72 61 74 69 6f 6e 4c 69 6d 69 74 3a 65 2e 66 6c 75 73 68 54 69 6d 65 6f 75 74 2c 70 61 67 65 45 78 69 74 4f 62 73 65 72 76 61 62 6c 65 3a 6f 2c 73 65 73 Data Ascii: u(e,t),c=n&&u(e,n);function u(e,t){var n=t.endpoint,s=t.encoder;return a({encoder:s,request:br(n,e.batchBytesLimit,r),flushController:kr({messagesLimit:e.batchMessagesLimit,bytesLimit:e.batchBytesLimit,durationLimit:e.flushTimeout,pageExitObservable:o,ses

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:14 UTC	551	OUT	GET /css/myriad-pro HTTP/1.1 Host: fonts.cdnfonts.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:14 UTC	938	IN	HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 20:29:14 GMT Content-Type: text/css;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 242810 Last-Modified: Wed, 19 Mar 2025 01:02:24 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YRPjfIjJf0BUAZKV2dbOnObiK0Hnr4lIACPrISNvso0HBX0ZYS%2BouzX4fsmAQCiiSNSk1ucoOoH4lCpHejvaRAZAq1UY6EXzSmN%2Fat2xq%2FuhDHQXcuI%2FKJE2OmJ24oTyyGuujTs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 924033471d1d41e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=103711&min_rtt=102663&rtt_var=23232&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1123&delivery_rate=35202&cwnd=234&unsent_bytes=0&cid=ce2a98e3b35e3255&ts=276&x=0"
2025-03-21 20:29:14 UTC	431	IN	Data Raw: 37 64 61 0d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4d 79 72 69 61 64 20 50 72 6f 27 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 73 72 63 3a 20 6c 6f 63 61 6c 28 27 4d 79 72 69 61 64 20 50 72 6f 27 29 2c 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 63 64 6e 66 6f 6e 74 73 2e 63 6f 6d 2f 73 2f 34 39 32 2f 4d 59 52 49 41 44 50 52 4f 2d 52 45 47 55 4c 41 52 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 0a 7d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4d 79 72 69 61 64 20 50 72 6f 27 3b 0a 20 20 20 20 66 Data Ascii: 7da@font-face { font-family: 'Myriad Pro'; font-style: normal; font-weight: 400; src: local('Myriad Pro'), url('https://fonts.cdnfonts.com/s/492/MYRIADPRO-REGULAR.woff') format('woff');}@font-face { font-family: 'Myriad Pro'; f
2025-03-21 20:29:14 UTC	1369	IN	Data Raw: 79 3a 20 27 4d 79 72 69 61 64 20 50 72 6f 27 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 69 74 61 6c 69 63 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 73 72 63 3a 20 6c 6f 63 61 6c 28 27 4d 79 72 69 61 64 20 50 72 6f 27 29 2c 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 63 64 6e 66 6f 6e 74 73 2e 63 6f 6d 2f 73 2f 34 39 32 2f 4d 59 52 49 41 44 50 52 4f 2d 43 4f 4e 44 49 54 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 0a 7d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4d 79 72 69 61 64 20 50 72 6f 27 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: y: 'Myriad Pro'; font-style: italic; font-weight: 400; src: local('Myriad Pro'), url('https://fonts.cdnfonts.com/s/492/MYRIADPRO-CONDIT.woff') format('woff');}@font-face { font-family: 'Myriad Pro'; font-style: normal; font-weigh
2025-03-21 20:29:14 UTC	217	IN	Data Raw: 6f 66 66 27 29 3b 0a 7d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4d 79 72 69 61 64 20 50 72 6f 27 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 69 74 61 6c 69 63 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 20 20 20 20 73 72 63 3a 20 6c 6f 63 61 6c 28 27 4d 79 72 69 61 64 20 50 72 6f 27 29 2c 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 63 64 6e 66 6f 6e 74 73 2e 63 6f 6d 2f 73 2f 34 39 32 2f 4d 59 52 49 41 44 50 52 4f 2d 42 4f 4c 44 43 4f 4e 44 49 54 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 0a 7d 0a 0a 0a 0d 0a Data Ascii: off');}@font-face { font-family: 'Myriad Pro'; font-style: italic; font-weight: 700; src: local('Myriad Pro'), url('https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLDCONDIT.woff') format('woff');}
2025-03-21 20:29:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:14 UTC	534	OUT	GET /dacs.js HTTP/1.1 Host: cs-cdn.deviceatlas.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:14 UTC	977	IN	HTTP/1.1 200 OK Server: nginx/1.27.2 Date: Fri, 21 Mar 2025 20:29:14 GMT Content-Type: application/javascript Content-Length: 21896 Connection: close Last-Modified: Wed, 24 Jan 2024 11:56:56 GMT ETag: "cfe6e4ceafbea9f6e6c1edad91770ce9" Expires: Fri, 21 Mar 2025 20:29:13 GMT Cache-Control: no-cache X-Cache: HIT Accept-CH: DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000
2025-03-21 20:29:14 UTC	15407	IN	Data Raw: 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 34 20 44 65 76 69 63 65 41 74 6c 61 73 20 4c 69 6d 69 74 65 64 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 68 74 74 70 3a 2f 2f 64 65 76 69 63 65 61 74 6c 61 73 2e 63 6f 6d 0a 20 2a 2f 0a 76 61 72 20 44 65 76 69 63 65 41 74 6c 61 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 6f 2e 6c 3d 21 30 2c 6f Data Ascii: /* * Copyright 2024 DeviceAtlas Limited. All rights reserved. * http://deviceatlas.com */var DeviceAtlas=function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o
2025-03-21 20:29:14 UTC	6489	IN	Data Raw: 6d 65 3b 20 63 6f 64 65 63 73 3d 22 61 70 34 78 22 27 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 3b 76 61 72 20 72 3d 6e 28 31 32 29 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 4f 62 6a 65 63 74 28 72 2e 61 29 28 27 76 69 64 65 6f 2f 6d 70 34 3b 20 63 6f 64 65 63 73 3d 22 61 76 30 31 2e 30 2e 30 35 4d 2e 30 38 22 27 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 2c 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 29 72 65 74 75 72 6e 20 65 3b 69 66 28 21 64 6f 63 75 6d 65 6e Data Ascii: me; codecs="ap4x"')}},function(e,t,n){"use strict";n.r(t);var r=n(12);t.default=function(e){return void 0!==e?e:Object(r.a)('video/mp4; codecs="av01.0.05M.08"')}},function(e,t,n){"use strict";n.r(t),t.default=function(e){if(void 0!==e)return e;if(!documen

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:14 UTC	1015	OUT	POST /ccm/collect?en=page_view&dl=https%3A%2F%2Frefinance.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=695489477.1742588953&dt=Quicken%20Loans%20-%20Talk%20to%20an%20Expert&auid=284078191.1742588953&navt=n&npa=0&gtm=45He53j1v9137104487za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102482433~102788824~102803279~102813109&tft=1742588953352&tfd=9253&apve=1 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://refinance.quickenloans.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0B Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:14 UTC	590	IN	HTTP/1.1 200 OK Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Date: Fri, 21 Mar 2025 20:29:14 GMT Content-Type: text/plain Expires: Fri, 01 Jan 1990 00:00:00 GMT Vary: Origin Vary: X-Origin Vary: Referer Server: scaffolding on HTTPServer2 Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://refinance.quickenloans.com Access-Control-Expose-Headers: date,vary,vary,vary,server,content-length Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-21 20:29:14 UTC	547	OUT	GET /ql-lre/pixel.js HTTP/1.1 Host: trackpixel.lowermybills.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-21 20:29:14 UTC	1325	IN	HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 20:29:14 GMT Content-Type: application/javascript Content-Length: 411 Connection: close last-modified: Wed, 19 Mar 2025 13:05:54 GMT etag: "3b17ce0364614fe5f226b31a7a1cac23" x-amz-server-side-encryption: AES256 x-amz-website-redirect-location: /ql-lre/pixel-d4065424c141a0f7623e.js x-amz-version-id: NsokyxL62BLTVjjtrn.uJXGBdagEQDH2 x-cache: Hit from cloudfront via: 1.1 1e5d213252e38a8aa2e2a927fd3c3754.cloudfront.net (CloudFront) x-amz-cf-pop: IAD55-P8 x-amz-cf-id: IPCQdPl41XTbh4xdwjzaT2mkppQodTZAym4z02GY7FDN33sj69oESw== CF-Cache-Status: HIT Age: 4148 Expires: Fri, 21 Mar 2025 22:29:14 GMT Cache-Control: public, max-age=7200 Accept-Ranges: bytes Set-Cookie: __cf_bm=RqEVREZmtHM.8u5zCoCJHeW.8K0WVeJQlMG3VRFSBG0-1742588954-1.0.1.1-8uFqtMRAL6iEXWRdgD5h76PRlOHD9x.TM13eJxs.wDVdy_pnw2HDNdxDHWfFpKS_o2Xl0xJRC_cNbFj.uGqSbxuPWCatb8a0A9lM.ibJiSQ; path=/; expires=Fri, 21-Mar-25 20:59:14 GMT; domain=.lowermybills.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'self' *.lowermybills.com app.optimizely.com analytics.google.com Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: cloudflare CF-RAY: 924033479a05adca-EWR
2025-03-21 20:29:14 UTC	44	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 Data Ascii: (function(){ if (document.getElementById('
2025-03-21 20:29:14 UTC	367	IN	Data Raw: 70 69 78 65 6c 2d 62 75 6e 64 6c 65 27 29 29 20 7b 0a 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 20 20 7d 0a 20 20 76 61 72 20 73 72 63 20 3d 20 27 27 3b 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 66 6f 72 28 76 61 72 20 69 20 3d 20 30 3b 69 20 3c 20 73 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0a 20 20 20 20 69 66 20 28 73 5b 69 5d 2e 73 72 63 2e 6d 61 74 63 68 28 27 70 69 78 65 6c 2e 6a 73 27 29 29 20 7b 0a 20 20 20 20 20 20 73 72 63 20 3d 20 73 5b 69 5d 2e 73 72 63 20 2b 20 27 27 3b 0a 20 20 20 20 20 20 62 72 65 61 6b 3b 0a 20 20 20 20 7d 0a 20 20 7d 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 Data Ascii: pixel-bundle')) { return false; } var src = ''; var s = document.getElementsByTagName('script'); for(var i = 0;i < s.length; i++) { if (s[i].src.match('pixel.js')) { src = s[i].src + ''; break; } } document.write('<scr