Edit tour

Windows Analysis Report
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true

Overview

General Information

Sample URL:	https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true
Analysis ID:	612085
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish29

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

HTML body contains low number of good links

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6196 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,9095700177972333494,10702462072518090882,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1964 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
50137.3.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	Avira URL Cloud: detection malicious, Label: malware
Source: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://office-access-documentcloud.myportfolio.com/	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://app.twilead.com/favicon.ico	Avira URL Cloud: Label: malware
Source: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true2	Avira URL Cloud: Label: malware

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 35.244.153.18:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.202.49.152:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.202.49.152:443 -> 192.168.2.5:49794 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true HTTP/1.1Host: app.twilead.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_preview/6be6dd1.js HTTP/1.1Host: cdn.msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_preview/a14acc7.js HTTP/1.1Host: cdn.msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_preview/cb3348a.js HTTP/1.1Host: cdn.msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_preview/26d7810.js HTTP/1.1Host: cdn.msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_preview/9f74505.js HTTP/1.1Host: cdn.msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_preview/7e27dcc.js HTTP/1.1Host: cdn.msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/user_session.js HTTP/1.1Host: msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/montserrat/v23/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://app.twilead.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Lato:400,700%7COpen%20Sans:400,700%7CMontserrat:400,700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3 HTTP/1.1Host: js.stripe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2XDkBvAJTC2RPZPKmXFm/media/624ae5bab871ee53e4546f5b.png HTTP/1.1Host: assets.cdn.msgsndr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.html HTTP/1.1Host: js.stripe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/fingerprinted/js/m-outer-8828f6fcad654313f23d9a7d1f1eb715.js HTTP/1.1Host: js.stripe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://js.stripe.com/v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /inner.html HTTP/1.1Host: m.stripe.networkConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://js.stripe.com/v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2XDkBvAJTC2RPZPKmXFm/media/624ae5bab871ee53e4546f5b.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: assets.cdn.msgsndr.com
Source: global traffic	HTTP traffic detected: GET /out-4.5.42.js HTTP/1.1Host: m.stripe.networkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://m.stripe.network/inner.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: app.twilead.com
Source: global traffic	HTTP traffic detected: GET /v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: app.twilead.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: app.twilead.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: msgsndr_id=4035320a-beaa-4d97-bb42-15b9958c4caa
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: office-access-documentcloud.myportfolio.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/css/main.css HTTP/1.1Host: office-access-documentcloud.myportfolio.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://office-access-documentcloud.myportfolio.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/translations?cb=cd81f8056bf78bbdba99c23111bbcd8486dc637d HTTP/1.1Host: office-access-documentcloud.myportfolio.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://office-access-documentcloud.myportfolio.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/js/main.js?cb=cd81f8056bf78bbdba99c23111bbcd8486dc637d HTTP/1.1Host: office-access-documentcloud.myportfolio.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://office-access-documentcloud.myportfolio.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: office-access-documentcloud.myportfolio.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/translations?cb=cd81f8056bf78bbdba99c23111bbcd8486dc637d HTTP/1.1Host: office-access-documentcloud.myportfolio.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://office-access-documentcloud.myportfolio.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: pnacl_public_x86_64_pnacl_sz_nexe.2.dr	String found in binary or memory: http://llvm.org/):
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, manifest.json0.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.2.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, manifest.json0.2.dr	String found in binary or memory: https://apis.google.com
Source: History Provider Cache.2.dr	String found in binary or memory: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true2
Source: pnacl_public_x86_64_pnacl_sz_nexe.2.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_pnacl_sz_nexe.2.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.2.dr, manifest.json.2.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: manifest.json0.2.dr	String found in binary or memory: https://content.googleapis.com
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, bd60bf8d-7385-422d-a264-c7a937633a32.tmp.3.dr, 1eee0dea-bcdd-45cb-9123-2b70669c6941.tmp.3.dr	String found in binary or memory: https://dns.google
Source: manifest.json0.2.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.2.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.2.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: craw_window.js.2.dr, craw_background.js.2.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: manifest.json0.2.dr	String found in binary or memory: https://hangouts.google.com/
Source: History Provider Cache.2.dr	String found in binary or memory: https://office-access-documentcloud.myportfolio.com/2
Source: History Provider Cache.2.dr	String found in binary or memory: https://office-access-documentcloud.myportfolio.com/2:
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.2.dr, manifest.json.2.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://r5---sn-4g5edn6r.gvt1.com
Source: 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.2.dr, manifest.json.2.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.2.dr, craw_background.js.2.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, manifest.json0.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.2.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.2.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: manifest.json0.2.dr	String found in binary or memory: https://www.google.com;
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, craw_window.js.2.dr, craw_background.js.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.2.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.2.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.2.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.2.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.2.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.2.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.2.dr	String found in binary or memory: https://www.gstatic.com;

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,9095700177972333494,10702462072518090882,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1964 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,9095700177972333494,10702462072518090882,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1964 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	7%	Virustotal		Browse
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	100%	Avira URL Cloud	malware
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	142.250.74.195	true	false	high
msgsndr.com	216.239.32.21	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
accounts.google.com	142.250.185.205	true	false	high
cdn.msgsndr.com	35.244.153.18	true	false	unknown
stripecdn.map.fastly.net	151.101.0.176	true	false	unknown
assets.cdn.msgsndr.com	35.244.153.18	true	false	unknown
services.leadconnectorhq.com	34.120.211.235	true	false	unknown
m.stripe.com	52.41.199.178	true	false	high
app.msgsndr.com	35.202.49.152	true	false	unknown
prod.adobe-prod-view.map.fastly.net	151.101.0.119	true	false	unknown
clients.l.google.com	142.250.184.238	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
use.typekit.net	unknown	unknown	false	high
m.stripe.network	unknown	unknown	false	high
js-agent.newrelic.com	unknown	unknown	false	high
office-access-documentcloud.myportfolio.com	unknown	unknown	false	high
use.fontawesome.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high
app.twilead.com	unknown	unknown	false	unknown
js.stripe.com	unknown	unknown	false	high
cdn.myportfolio.com	unknown	unknown	false	high
bam-cell.nr-data.net	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.0.176	stripecdn.map.fastly.net	United States	54113	FASTLYUS	false
52.41.199.178	m.stripe.com	United States	16509	AMAZON-02US	false
142.250.185.205	accounts.google.com	United States	15169	GOOGLEUS	false
151.101.0.119	prod.adobe-prod-view.map.fastly.net	United States	54113	FASTLYUS	false
34.120.211.235	services.leadconnectorhq.com	United States	15169	GOOGLEUS	false
35.244.153.18	cdn.msgsndr.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.74.195	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
35.202.49.152	app.msgsndr.com	United States	15169	GOOGLEUS	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
216.239.32.21	msgsndr.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.238	clients.l.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.1
127.0.0.1

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\6196_509228749\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\6196_509228749\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://office-access-documentcloud.myportfolio.com/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://msgsndr.com/js/user_session.js	0%	Virustotal		Browse
https://msgsndr.com/js/user_session.js	0%	Avira URL Cloud	safe
https://services.leadconnectorhq.com/appengine/funnel/event	0%	Avira URL Cloud	safe
https://cdn.msgsndr.com/_preview/a14acc7.js	0%	Avira URL Cloud	safe
https://cdn.msgsndr.com/_preview/6be6dd1.js	0%	Avira URL Cloud	safe
https://app.twilead.com/favicon.ico	100%	Avira URL Cloud	malware
https://cdn.msgsndr.com/_preview/26d7810.js	0%	Avira URL Cloud	safe
https://cdn.msgsndr.com/_preview/9f74505.js	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://cdn.msgsndr.com/_preview/cb3348a.js	0%	Avira URL Cloud	safe
https://www.google.com;	0%	Avira URL Cloud	safe
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true2	100%	Avira URL Cloud	malware
https://assets.cdn.msgsndr.com/2XDkBvAJTC2RPZPKmXFm/media/624ae5bab871ee53e4546f5b.png	0%	Avira URL Cloud	safe
https://cdn.msgsndr.com/_preview/7e27dcc.js	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://msgsndr.com/js/user_session.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://office-access-documentcloud.myportfolio.com/dist/css/main.css	false		high
https://office-access-documentcloud.myportfolio.com/	false	SlashNext: Credential Stealing type: Phishing & Social Engineering	high
https://a.nel.cloudflare.com/report/v3?s=wt4HBui%2Bi1AToVhWpM0fsS7fU8j29vPOLdLw1dbpTWtaRnXXLYHOoLUE5oFOUoATQQ3t76YxQGxkpcmKCpRGcijpirPVvq3XuI0%2B9t81757AhJJQXe3esmAAPFytd7co167mlIkD	false		high
https://office-access-documentcloud.myportfolio.com/dist/js/main.js?cb=cd81f8056bf78bbdba99c23111bbcd8486dc637d	false		high
https://js.stripe.com/v3	false		high
https://m.stripe.network/inner.html#url=https%3A%2F%2Fapp.twilead.com%2Fv2%2Fpreview%2Fyn7vOTKQAH2FF4b9Mos0%3Fnotrack%3Dtrue&title=(2)%20Pending%20Document%20%7C%20Access%20Document%20Cloud&referrer=&muid=NA&sid=NA&version=6&preview=false	false		high
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
https://services.leadconnectorhq.com/appengine/funnel/event	false	Avira URL Cloud: safe	unknown
https://cdn.msgsndr.com/_preview/a14acc7.js	false	Avira URL Cloud: safe	unknown
https://js.stripe.com/v3/fingerprinted/js/m-outer-8828f6fcad654313f23d9a7d1f1eb715.js	false		high
https://cdn.msgsndr.com/_preview/6be6dd1.js	false	Avira URL Cloud: safe	unknown
https://app.twilead.com/favicon.ico	false	Avira URL Cloud: malware	unknown
https://cdn.msgsndr.com/_preview/26d7810.js	false	Avira URL Cloud: safe	unknown
https://js.stripe.com/v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.html#url=https%3A%2F%2Fapp.twilead.com%2Fv2%2Fpreview%2Fyn7vOTKQAH2FF4b9Mos0%3Fnotrack%3Dtrue&title=(2)%20Pending%20Document%20%7C%20Access%20Document%20Cloud&referrer=&muid=NA&sid=NA&version=6&preview=false	false		high
https://cdn.msgsndr.com/_preview/9f74505.js	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://cdn.msgsndr.com/_preview/cb3348a.js	false	Avira URL Cloud: safe	unknown
https://m.stripe.network/inner.html	false		high
https://js.stripe.com/v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.html	false		high
https://office-access-documentcloud.myportfolio.com/site/translations?cb=cd81f8056bf78bbdba99c23111bbcd8486dc637d	false		high
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	true		unknown
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	false		unknown
https://assets.cdn.msgsndr.com/2XDkBvAJTC2RPZPKmXFm/media/624ae5bab871ee53e4546f5b.png	false	Avira URL Cloud: safe	unknown
https://cdn.msgsndr.com/_preview/7e27dcc.js	false	Avira URL Cloud: safe	unknown
https://m.stripe.network/out-4.5.42.js	false		high
https://m.stripe.com/6	false		high
https://office-access-documentcloud.myportfolio.com/	false	SlashNext: Credential Stealing type: Phishing & Social Engineering	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/images/cleardot.gif	craw_window.js.2.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.2.dr, manifest.json.2.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.2.dr	false		high
https://www.google.com	44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, manifest.json0.2.dr	false		high
https://office-access-documentcloud.myportfolio.com/2	History Provider Cache.2.dr	false		high
https://accounts.google.com	44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, manifest.json0.2.dr	false		high
https://apis.google.com	44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, manifest.json0.2.dr	false		high
https://office-access-documentcloud.myportfolio.com/2:	History Provider Cache.2.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.2.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.2.dr, craw_background.js.2.dr	false		high
https://clients2.google.com	44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	false		high
https://dns.google	44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr, bd60bf8d-7385-422d-a264-c7a937633a32.tmp.3.dr, 1eee0dea-bcdd-45cb-9123-2b70669c6941.tmp.3.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.2.dr, craw_background.js.2.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.2.dr	false		high
https://ogs.google.com	44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.2.dr, manifest.json.2.dr	false		high
https://www.google.com;	manifest.json0.2.dr	false	Avira URL Cloud: safe	low
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_pnacl_sz_nexe.2.dr	false		high
https://hangouts.google.com/	manifest.json0.2.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.2.dr	false		high
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true2	History Provider Cache.2.dr	true	Avira URL Cloud: malware	unknown
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.2.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.2.dr	false		high
https://clients2.googleusercontent.com	44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp.3.dr, 68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp.3.dr	false		high
https://www.google.com/	manifest.json.2.dr	false		high
https://feedback.googleusercontent.com	manifest.json0.2.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_pnacl_sz_nexe.2.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.2.dr, manifest.json.2.dr	false		high

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	612085
Start date and time: 20/04/202214:55:21	2022-04-20 14:55:21 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.phis.win@33/141@22/15
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://office-access-documentcloud.myportfolio.com/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 14:56:36.691715956 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:36.691781044 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:36.691905022 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:36.692665100 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:36.692698002 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:36.692770004 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:36.693290949 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:36.693331957 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:36.693883896 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:36.693896055 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:36.742012024 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:36.742577076 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:36.742603064 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:36.743454933 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:36.743654966 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:36.743763924 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:36.757735014 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:36.757793903 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:36.758219957 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:36.758305073 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:36.759013891 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:36.759076118 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:36.895833969 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:36.895885944 CEST	443	49749	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:36.895999908 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:36.896845102 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:36.896873951 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:36.896960974 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:36.897972107 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:36.898000956 CEST	443	49749	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:36.898359060 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:36.898376942 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.172395945 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:37.172601938 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:37.173353910 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:37.173494101 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:37.173866034 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:37.173898935 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:37.174153090 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:37.174184084 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:37.202579021 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:37.202692032 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:37.202734947 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:37.202758074 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:37.202846050 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:37.206609011 CEST	49746	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:37.206645966 CEST	443	49746	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:37.224709988 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:37.224803925 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:37.224816084 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:37.224884987 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:37.242378950 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.242706060 CEST	49748	443	192.168.2.5	142.250.185.205
Apr 20, 2022 14:56:37.242729902 CEST	443	49748	142.250.185.205	192.168.2.5
Apr 20, 2022 14:56:37.246052027 CEST	443	49749	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.257515907 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.257551908 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.258057117 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.258073092 CEST	443	49749	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.259259939 CEST	443	49749	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.259370089 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.259569883 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.259680986 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.268137932 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.268287897 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.268835068 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.269000053 CEST	443	49749	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.271348000 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.271377087 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.351283073 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.351306915 CEST	443	49749	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:37.351315975 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:37.451438904 CEST	49749	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:38.059900045 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.059942007 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.059952021 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.059973001 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.059982061 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.059992075 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060090065 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:38.060127974 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060146093 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060174942 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060194016 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060220003 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:38.060220957 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060236931 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060245991 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:38.060250998 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.060311079 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:38.222997904 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.223018885 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.223037958 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.223051071 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.223076105 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.223102093 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.223103046 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:38.223174095 CEST	49750	443	192.168.2.5	35.202.49.152
Apr 20, 2022 14:56:38.223351955 CEST	443	49750	35.202.49.152	192.168.2.5
Apr 20, 2022 14:56:38.223362923 CEST	443	49750	35.202.49.152	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 14:56:36.614296913 CEST	53934	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:36.632715940 CEST	53	53934	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:36.637250900 CEST	63187	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:36.662456989 CEST	62466	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:36.689023018 CEST	53	62466	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:36.831871033 CEST	53	63187	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:38.513016939 CEST	61941	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:38.532119989 CEST	57352	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:38.533829927 CEST	53	61941	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:38.540893078 CEST	63538	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:38.563256025 CEST	53	63538	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:39.536703110 CEST	61478	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:39.553235054 CEST	53	61478	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:39.693387032 CEST	57809	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:39.714931965 CEST	53	57809	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:39.726190090 CEST	55355	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:39.747201920 CEST	53	55355	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:42.663932085 CEST	49912	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:42.680371046 CEST	53	49912	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:43.219748020 CEST	63488	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:43.253897905 CEST	53	63488	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:43.274085999 CEST	57990	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:43.295981884 CEST	53	57990	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:45.260690928 CEST	54463	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:45.280563116 CEST	53	54463	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:49.824728012 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:49.849534988 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:49.951159000 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:50.105030060 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:50.105079889 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:50.105108023 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:50.105138063 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:50.129106045 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:50.139364958 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:50.171576977 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:50.172240019 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:50.197146893 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:50.209640980 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:50.209949970 CEST	443	63720	142.250.184.238	192.168.2.5
Apr 20, 2022 14:56:50.238585949 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:50.238892078 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:56:52.446183920 CEST	49416	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:52.467776060 CEST	53	49416	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:52.855288982 CEST	61126	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:53.146939993 CEST	54152	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:54.074096918 CEST	53194	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:54.079763889 CEST	50393	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:54.192006111 CEST	55870	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:54.798629999 CEST	54850	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:56:54.823236942 CEST	53	54850	8.8.8.8	192.168.2.5
Apr 20, 2022 14:56:55.960369110 CEST	61458	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:57:04.799855947 CEST	55316	53	192.168.2.5	8.8.8.8
Apr 20, 2022 14:57:04.818399906 CEST	53	55316	8.8.8.8	192.168.2.5
Apr 20, 2022 14:57:05.180675983 CEST	63720	443	192.168.2.5	142.250.184.238
Apr 20, 2022 14:57:05.224237919 CEST	443	63720	142.250.184.238	192.168.2.5

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:37 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:37 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-hnAJMQ0WCfhhdHGTgI14ng' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 20 Apr 2022 12:56:37 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5588 X-Daystart: 21397 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-20 12:56:37 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 38 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 31 33 39 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5588" elapsed_seconds="21397"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-04-20 12:56:37 UTC	2	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-04-20 12:56:37 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:37 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:37 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-04-20 12:56:37 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 20 Apr 2022 12:56:37 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-cKhIKMegxviX9NW7T1NwwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-cKhIKMegxviX9NW7T1NwwQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-20 12:56:37 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-04-20 12:56:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\1a4913fe-8f6c-4748-b011-b8b02e9273cc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\342ca822-8a46-43be-ba15-a571ed05fd0d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4cfcae05-8467-4e26-99ee-d99226d1a890.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\665ff1af-332b-4964-aac0-28e59a978970.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6727613f-432b-4839-8942-3a99202186f0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\8750d148-a1c7-40fe-9459-28d1c42ec083.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0cf70d7c-3d89-4fa4-97ec-324360ca34b8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1fa2a788-9d93-4794-b1c7-b42b6f444a56.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\33b37057-4fb2-4533-931b-9e5aa3d6cd98.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3e4b5c55-263c-4d9c-9be5-6033104a88b2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\44f04ca0-2057-4c12-a294-917c51ab4fa1.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\68560d4f-1d1e-477e-b2a7-551ff87ea9c5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7a3d724b-bd93-4261-a0b0-d3cf399f1fd8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\805b6798-5106-4f63-a45d-51b0ed2dba25.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\1eee0dea-bcdd-45cb-9123-2b70669c6941.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

Windows Analysis Report
https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:39 UTC	641	OUT	OPTIONS /appengine/funnel/event HTTP/1.1 Host: services.leadconnectorhq.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://app.twilead.com Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:39 UTC	643	IN	HTTP/1.1 200 OK X-Powered-By: Express Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: content-type Content-Length: 0 Date: Wed, 20 Apr 2022 12:56:39 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:40 UTC	869	OUT	POST /appengine/funnel/event HTTP/1.1 Host: services.leadconnectorhq.com Connection: keep-alive Content-Length: 314 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/json Origin: https://app.twilead.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:40 UTC	870	OUT	Data Raw: 7b 22 66 75 6e 6e 65 6c 5f 69 64 22 3a 22 74 51 79 69 68 73 48 73 76 56 72 74 63 51 52 68 59 33 32 4d 22 2c 22 70 61 67 65 5f 69 64 22 3a 22 79 6e 37 76 4f 54 4b 51 41 48 32 46 46 34 62 39 4d 6f 73 30 22 2c 22 64 6f 6d 61 69 6e 5f 6e 61 6d 65 22 3a 22 66 75 6e 6e 65 6c 2d 70 72 65 76 69 65 77 2d 73 65 72 76 69 63 65 2e 64 65 66 61 75 6c 74 2e 73 76 63 2e 63 6c 75 73 74 65 72 2e 6c 6f 63 61 6c 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 2f 76 32 2f 70 72 65 76 69 65 77 2f 79 6e 37 76 4f 54 4b 51 41 48 32 46 46 34 62 39 4d 6f 73 30 22 2c 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 34 30 33 35 33 32 30 61 2d 62 65 61 61 2d 34 64 39 37 2d 62 62 34 32 2d 31 35 62 39 39 35 38 63 34 63 61 61 22 2c 22 66 75 6e 6e 65 6c 5f 73 74 65 70 5f 69 64 22 3a 22 36 62 61 36 Data Ascii: {"funnel_id":"tQyihsHsvVrtcQRhY32M","page_id":"yn7vOTKQAH2FF4b9Mos0","domain_name":"funnel-preview-service.default.svc.cluster.local","page_url":"/v2/preview/yn7vOTKQAH2FF4b9Mos0","fingerprint":"4035320a-beaa-4d97-bb42-15b9958c4caa","funnel_step_id":"6ba6
2022-04-20 12:56:40 UTC	870	IN	HTTP/1.1 200 OK X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 2 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Date: Wed, 20 Apr 2022 12:56:40 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2022-04-20 12:56:40 UTC	870	IN	Data Raw: 4f 4b Data Ascii: OK

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:41 UTC	1168	OUT	GET /v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.html HTTP/1.1 Host: js.stripe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:41 UTC	1168	IN	HTTP/1.1 200 OK Connection: close Content-Length: 240 Last-Modified: Tue, 05 Apr 2022 17:50:14 GMT ETag: "23335cd0c833d03926d94e8fb5cb0381" Cache-Control: max-age=31536000 Content-Type: text/html; charset=utf-8 content-security-policy: default-src 'self'; base-uri 'none'; form-action 'none'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report strict-transport-security: max-age=31556926; includeSubDomains; preload x-content-type-options: nosniff access-control-allow-origin: * server: Fastly Accept-Ranges: bytes Date: Wed, 20 Apr 2022 12:56:41 GMT Via: 1.1 varnish Age: 1274364 X-Request-ID: 0eb166cb-4074-463d-b05d-4bac3e55404b X-Served-By: cache-mxp6967-MXP X-Cache: HIT X-Cache-Hits: 1 Vary: Accept-Encoding Timing-Allow-Origin: *
2022-04-20 12:56:41 UTC	1169	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 73 74 72 69 70 65 2e 63 6f 6d 2f 76 33 2f 66 69 6e 67 65 72 70 72 69 6e 74 65 64 2f 6a 73 2f 6d 2d 6f 75 74 65 72 2d 38 38 32 38 66 36 66 63 61 64 36 35 34 33 31 33 66 32 33 64 39 61 37 64 31 66 31 65 62 37 31 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html><head><meta charset="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/></head><body><script src="https://js.stripe.com/v3/fingerprinted/js/m-outer-8828f6fcad654313f23d9a7d1f1eb715.js"></script></body></html>

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:41 UTC	1170	OUT	GET /v3/fingerprinted/js/m-outer-8828f6fcad654313f23d9a7d1f1eb715.js HTTP/1.1 Host: js.stripe.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://js.stripe.com/v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:41 UTC	1170	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1495 Last-Modified: Tue, 05 Apr 2022 17:50:29 GMT ETag: "d0c7e21ec457b6a134a496f107c3ca93" Cache-Control: max-age=60 Content-Type: application/javascript; charset=utf-8 strict-transport-security: max-age=31556926; includeSubDomains; preload x-content-type-options: nosniff access-control-allow-origin: * server: Fastly Accept-Ranges: bytes Date: Wed, 20 Apr 2022 12:56:41 GMT Via: 1.1 varnish Age: 0 X-Request-ID: 62b8bbb0-495c-4929-aea7-e848ac765fb5 X-Served-By: cache-mxp6937-MXP X-Cache: HIT X-Cache-Hits: 1 Vary: Accept-Encoding Timing-Allow-Origin: *
2022-04-20 12:56:41 UTC	1171	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 72 29 7b 69 66 28 6e 5b 72 5d 29 72 65 74 75 72 6e 20 6e 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 6e 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 74 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 6e 3d 7b 7d 3b 74 2e 6d 3d 65 2c 74 2e 63 3d 6e 2c 74 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 72 29 7b 74 2e 6f 28 65 2c 6e 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 6e 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 7d 29 7d 2c 74 2e 72 3d 66 75 6e Data Ascii: !function(e){function t(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,t),o.l=!0,o.exports}var n={};t.m=e,t.c=n,t.d=function(e,n,r){t.o(e,n)\|\|Object.defineProperty(e,n,{enumerable:!0,get:r})},t.r=fun
2022-04-20 12:56:41 UTC	1172	IN	Data Raw: 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 6f 2c 21 31 29 3a 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 4d 65 73 73 61 67 65 22 2c 6f 29 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 26 26 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 7d 29 3b Data Ascii: ow.addEventListener("message",o,!1):window.attachEvent("onMessage",o),document.body&&document.body.appendChild(r)}});

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:42 UTC	1172	OUT	GET /inner.html HTTP/1.1 Host: m.stripe.network Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://js.stripe.com/v3/m-outer-23335cd0c833d03926d94e8fb5cb0381.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:42 UTC	1173	IN	HTTP/1.1 200 OK Connection: close Content-Length: 930 Cache-Control: max-age=300, public Content-Type: text/html; charset=utf-8 content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report strict-transport-security: max-age=31556926; includeSubDomains; preload x-content-type-options: nosniff server: Fastly Accept-Ranges: bytes Date: Wed, 20 Apr 2022 12:56:42 GMT Via: 1.1 varnish Age: 346 X-Request-ID: 6050a195-d749-4500-bfaf-d33a59614f89 X-Served-By: cache-mxp6922-MXP X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1650459403.828786,VS0,VE1 Vary: Accept-Encoding, Origin
2022-04-20 12:56:42 UTC	1174	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 74 72 69 70 65 4d 2d 49 6e 6e 65 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 65 2e 64 65 66 65 72 3d 21 30 2c 65 2e 73 72 63 3d 22 6f 75 74 2d 34 2e 35 2e 34 32 2e 6a 73 22 2c 65 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 77 69 6e 64 6f 77 2e 53 74 72 69 70 65 4d 26 26 28 65 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 2c 2f 70 69 6e 67 3d 66 Data Ascii: <!doctype html><html><head><meta charset="utf-8"><title>StripeM-Inner</title></head><body><script>!function(){var e=document.createElement("script");e.defer=!0,e.src="out-4.5.42.js",e.onload=function(){var e;window.StripeM&&(e=window.location.hash,/ping=f

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:37 UTC	5	OUT	GET /v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true HTTP/1.1 Host: app.twilead.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:38 UTC	5	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Apr 2022 12:56:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 266086 Connection: close Vary: Accept-Encoding Link: <https://cdn.msgsndr.com/_preview/6be6dd1.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/a14acc7.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/26d7810.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/cb3348a.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/9f74505.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/7e27dcc.js>; rel=preload; as=script Accept-Ranges: none Vary: Accept-Encoding
2022-04-20 12:56:38 UTC	6	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 6e 2d 68 65 61 64 2d 73 73 72 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 25 37 42 25 32 32 6c 61 6e 67 25 32 32 3a 25 37 42 25 32 32 73 73 72 25 32 32 3a 25 32 32 65 6e 25 32 32 25 37 44 25 37 44 22 3e 0a 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 28 32 29 20 50 65 6e 64 69 6e 67 20 44 6f 63 75 6d 65 6e 74 20 7c 20 41 63 63 65 73 73 20 44 6f 63 75 6d 65 6e 74 20 43 6c 6f 75 64 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html data-n-head-ssr lang="en" data-n-head="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D%7D"> <head > <title>(2) Pending Document \| Access Document Cloud</title><meta data-n-head="ssr" charset="utf-8"><meta data-n-head="ssr" name="viewpor
2022-04-20 12:56:38 UTC	21	IN	Data Raw: 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 7d 0a 2e 73 68 61 64 6f 77 33 30 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 35 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 29 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 35 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 29 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 Data Ascii: rgba(0, 0, 0, 0.2); -moz-box-shadow: 0 1px 5px rgba(0, 0, 0, 0.2); box-shadow: 0 1px 5px rgba(0, 0, 0, 0.2);}.shadow30 { -webkit-box-shadow: 0 2px 5px 2px rgba(0, 0, 0, 0.3); -moz-box-shadow: 0 2px 5px 2px rgba(0, 0, 0, 0.3); box-shadow: 0 2p
2022-04-20 12:56:38 UTC	37	IN	Data Raw: 20 20 20 20 20 20 0a 23 68 6c 5f 6d 61 69 6e 5f 70 6f 70 75 70 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 70 78 3b 0a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 67 72 61 79 29 3b 0a 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 30 70 78 3b 0a 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 68 69 74 65 29 3b 20 77 69 64 74 68 3a 37 32 30 70 78 3b 20 7d 20 0a 20 20 20 20 23 63 6f 6c 2d 38 70 38 39 67 34 54 Data Ascii: #hl_main_popup { padding-top: 20px;padding-bottom: 20px;padding-left: 20px;padding-right: 20px;margin-top: 0px;border-color: var(--gray);border-width: 10px;border-style: solid;background-color: var(--white); width:720px; } #col-8p89g4T
2022-04-20 12:56:38 UTC	53	IN	Data Raw: 67 3a 31 72 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 72 65 6d 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6c 2d 61 70 70 20 2e 76 64 70 2d 64 61 74 65 70 69 63 6b 65 72 5f 5f 63 61 6c 65 6e 64 61 72 20 2e 63 65 6c 6c 2e 73 65 6c 65 63 74 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 31 38 38 62 66 36 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 68 6c 2d 61 70 70 20 2e 76 64 70 2d 64 61 74 65 70 69 63 6b 65 72 5f 5f 63 61 6c 65 6e 64 61 72 20 2e 63 65 6c 6c 2e 73 65 6c 65 63 74 65 64 2e 64 69 73 61 62 6c 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 64 64 64 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6c 2d 61 70 70 20 2e 68 6c 5f 65 76 65 Data Ascii: g:1rem!important;margin-bottom:3rem!important}.hl-app .vdp-datepicker__calendar .cell.selected{background:#188bf6!important;color:#fff}.hl-app .vdp-datepicker__calendar .cell.selected.disabled{background:#fff!important;color:#ddd!important}.hl-app .hl_eve
2022-04-20 12:56:38 UTC	69	IN	Data Raw: 33 32 70 78 3b 68 65 69 67 68 74 3a 33 32 70 78 7d 2e 68 6c 2d 61 70 70 20 2e 6f 70 74 69 6f 6e 20 2e 6f 70 74 69 6f 6e 2d 6c 67 20 6c 61 62 65 6c 3a 61 66 74 65 72 7b 77 69 64 74 68 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 74 6f 70 3a 36 70 78 3b 6c 65 66 74 3a 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 72 65 6d 7d 2e 68 6c 2d 61 70 70 20 2e 6f 70 74 69 6f 6e 2d 72 61 64 69 6f 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 78 74 5d 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 31 65 31 65 31 3b 70 61 64 64 69 6e 67 3a 35 70 78 3b 77 69 64 74 68 3a 32 35 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 7d 2e 68 Data Ascii: 32px;height:32px}.hl-app .option .option-lg label:after{width:20px;height:20px;top:6px;left:6px;font-size:.75rem}.hl-app .option-radio input[type=text]{border:none;border-bottom:1px solid #e1e1e1;padding:5px;width:255px;border-radius:3px;background:0 0}.h
2022-04-20 12:56:38 UTC	85	IN	Data Raw: 20 72 67 62 61 28 34 39 2c 34 39 2c 39 33 2c 2e 31 29 2c 30 20 31 70 78 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 38 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 77 69 64 74 68 3a 32 33 30 70 78 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 38 70 78 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 68 6c 2d 61 70 70 20 2e 70 61 79 66 6f 72 6d 20 2e 73 75 63 63 65 73 73 2e 76 69 73 69 62 6c 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 7d 2e 68 6c 2d 61 70 70 20 2e 70 61 79 66 6f 72 6d 20 2e 65 72 72 6f 72 7b 63 6f 6c 6f 72 3a 23 Data Ascii: rgba(49,49,93,.1),0 1px 2px 0 rgba(0,0,0,.08);border-radius:4px;border:0;margin-top:20px;font-size:15px;font-weight:400;width:230px;height:40px;line-height:38px;outline:none}.hl-app .payform .success.visible{display:inline}.hl-app .payform .error{color:#
2022-04-20 12:56:38 UTC	101	IN	Data Raw: 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 61 75 74 6f 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6d 64 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 7b 77 69 64 74 68 3a 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 6f 70 61 63 69 74 79 3a 30 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 31 3b 77 69 6c 6c 2d 63 68 61 6e 67 65 3a 74 72 61 6e 73 66 6f 72 6d 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6d 64 3a 3a Data Ascii: center;align-items:center;overflow-y:auto}.appointment_widgets-md::-webkit-scrollbar{width:5px;position:absolute;top:0;left:0;border-radius:4px;background:#fff;opacity:0;cursor:default;outline:none;z-index:1;will-change:transform}.appointment_widgets-md::
2022-04-20 12:56:38 UTC	117	IN	Data Raw: 69 6e 2d 74 6f 70 3a 30 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 78 6c 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 64 61 74 65 70 69 63 6b 2d 69 6e 66 6f 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 37 72 65 6d 3b 6c 65 66 74 3a 30 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 35 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 31 37 29 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 64 72 6f 70 2d 66 69 6c 74 65 72 3a 62 6c 75 72 28 33 70 Data Ascii: in-top:0}.appointment_widgets-xl .appointment_widgets--booking .appointment_widgets--steps .widgets-date-block .datepick-info{position:absolute;top:7rem;left:0;height:100%;width:100%;z-index:5;background:hsla(0,0%,100%,.17);-webkit-backdrop-filter:blur(3p
2022-04-20 12:56:38 UTC	133	IN	Data Raw: 62 6c 61 63 6b 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6c 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 65 76 65 72 73 65 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 2d 72 65 76 65 72 73 65 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 Data Ascii: black-text-color);font-weight:700}.appointment_widgets-lg .appointment_widgets--booking{display:-webkit-box;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:reverse;flex-direction:column-reverse;height:100%;flex-direction:column}@media only
2022-04-20 12:56:38 UTC	149	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 31 2e 33 72 65 6d 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 33 65 33 65 33 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6c 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 77 69 64 67 65 74 73 2d 61 63 74 69 6f 6e 2d 62 75 74 74 6f 6e 73 3e 64 Data Ascii: ay:flex;-webkit-box-align:center;align-items:center;padding:1.3rem;border-top:1px solid #e3e3e3;border-top:1px solid var(--appointment_widgets-border-color);border-bottom:none}.appointment_widgets-lg .appointment_widgets--booking .widgets-action-buttons>d
2022-04-20 12:56:38 UTC	501	IN	Data Raw: 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 76 64 70 43 65 6c 6c 20 2e 76 64 70 43 65 6c 6c 43 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 36 64 36 64 36 3b 77 69 64 74 68 3a 35 35 70 78 3b 68 65 69 67 68 74 3a 35 35 70 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 Data Ascii: nt_widgets--booking .appointment_widgets--steps .widgets-date-block .vdpCell .vdpCellContent{position:relative;border:1px solid #d6d6d6;width:55px;height:55px;display:-webkit-box;display:flex;-webkit-box-align:center;align-items:center;-webkit-box-pack:ce
2022-04-20 12:56:38 UTC	517	IN	Data Raw: 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 73 6d 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 64 61 74 65 2d 70 69 63 6b 65 72 2d 63 61 6c 65 6e 64 61 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 72 65 6d 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 73 6d 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 Data Ascii: ify-content:space-between}.appointment_widgets-sm .appointment_widgets--booking .appointment_widgets--steps .widgets-date-block .date-picker-calendar{margin-top:1rem}.appointment_widgets-sm .appointment_widgets--booking .appointment_widgets--steps .widget
2022-04-20 12:56:38 UTC	541	IN	Data Raw: 64 65 46 72 6f 6d 4c 65 66 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 2e 35 65 6d 2c 30 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 2e 35 65 6d 2c 30 2c 30 29 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 76 64 70 53 6c 69 64 65 46 72 6f 6d 52 69 67 68 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2e 35 65 6d 2c 30 2c Data Ascii: deFromLeft{0%{opacity:0;-webkit-transform:translate3d(-.5em,0,0);transform:translate3d(-.5em,0,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes vdpSlideFromRight{0%{opacity:0;-webkit-transform:translate3d(.5em,0,
2022-04-20 12:56:38 UTC	557	IN	Data Raw: 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e Data Ascii: ...--> ...--> ...--> ...--> ...--> ...--> ...--></div></div> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--></div></div> ...--> ...-->
2022-04-20 12:56:38 UTC	573	IN	Data Raw: 70 3a 20 30 3b 5c 6e 20 20 62 6f 74 74 6f 6d 3a 20 30 3b 5c 6e 20 20 77 69 64 74 68 3a 20 31 2e 35 72 65 6d 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 39 39 39 39 70 78 3b 5c 6e 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 30 2e 32 35 72 65 6d 3b 5c 6e 5c 6e 20 20 72 69 67 68 74 3a 20 35 30 25 3b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 27 27 3b 5c 6e 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 3b 5c 6e 7d 5c 6e 5c 6e 2e 66 6f 72 6d 2d 73 77 69 74 63 68 2d 63 68 65 63 6b 62 6f 78 3a 63 68 65 63 6b 65 64 20 2b 20 2e 66 6f 72 6d 2d 73 77 69 74 63 68 2d 6c 61 62 65 6c 20 7b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 66 66 34 3b 5c 6e 20 20 62 6f 78 2d 73 68 61 Data Ascii: p: 0;\n bottom: 0;\n width: 1.5rem;\n border-radius: 9999px;\n margin-left: -0.25rem;\n\n right: 50%;\n content: '';\n transition: all 0.2s ease-in;\n}\n\n.form-switch-checkbox:checked + .form-switch-label {\n background-color: #f0fff4;\n box-sha
2022-04-20 12:56:39 UTC	589	IN	Data Raw: 30 2c 20 30 2e 31 35 29 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 35 29 3b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 5c 6e 7d 5c 6e 2e 62 6f 72 64 65 72 34 20 7b 5c 6e 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 35 29 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 35 29 3b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 7d 5c 6e 2e 73 68 61 64 6f 77 31 20 7b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 30 70 78 20 36 70 78 20 2d 36 70 78 Data Ascii: 0, 0.15);\n border-bottom: 2px solid rgba(0, 0, 0, 0.15);\n padding: 5px;\n}\n.border4 {\n border: 1px solid rgba(0, 0, 0, 0.35);\n border-bottom: 2px solid rgba(0, 0, 0, 0.35);\n padding: 1px !important;\n}\n.shadow1 {\n box-shadow: 0 10px 6px -6px
2022-04-20 12:56:39 UTC	605	IN	Data Raw: 6f 72 3a 7b 76 61 6c 75 65 3a 61 67 7d 7d 2c 77 72 61 70 70 65 72 3a 7b 7d 2c 63 75 73 74 6f 6d 43 73 73 3a 5b 5d 2c 69 64 3a 61 68 2c 63 68 69 6c 64 3a 5b 61 69 5d 2c 6d 65 74 61 3a 61 68 2c 74 69 74 6c 65 3a 22 50 6f 70 75 70 22 2c 74 61 67 3a 62 2c 75 70 64 61 74 65 64 3a 66 7d 2c 7b 69 64 3a 61 69 2c 74 79 70 65 3a 72 2c 63 68 69 6c 64 3a 5b 61 6a 5d 2c 63 6c 61 73 73 3a 7b 61 6c 69 67 6e 52 6f 77 3a 7b 76 61 6c 75 65 3a 41 7d 2c 62 6f 78 53 68 61 64 6f 77 3a 7b 76 61 6c 75 65 3a 65 7d 2c 62 6f 72 64 65 72 73 3a 7b 76 61 6c 75 65 3a 67 7d 2c 62 6f 72 64 65 72 52 61 64 69 75 73 3a 7b 76 61 6c 75 65 3a 68 7d 2c 72 61 64 69 75 73 45 64 67 65 3a 7b 76 61 6c 75 65 3a 65 7d 7d 2c 73 74 79 6c 65 73 3a 7b 70 61 64 64 69 6e 67 4c 65 66 74 3a 7b 75 6e 69 74 3a Data Ascii: or:{value:ag}},wrapper:{},customCss:[],id:ah,child:[ai],meta:ah,title:"Popup",tag:b,updated:f},{id:ai,type:r,child:[aj],class:{alignRow:{value:A},boxShadow:{value:e},borders:{value:g},borderRadius:{value:h},radiusEdge:{value:e}},styles:{paddingLeft:{unit:

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:43 UTC	1439	OUT	GET /v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: app.twilead.com
2022-04-20 12:56:44 UTC	1490	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Apr 2022 12:56:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 266086 Connection: close Vary: Accept-Encoding Link: <https://cdn.msgsndr.com/_preview/6be6dd1.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/a14acc7.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/26d7810.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/cb3348a.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/9f74505.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/7e27dcc.js>; rel=preload; as=script Accept-Ranges: none Vary: Accept-Encoding
2022-04-20 12:56:44 UTC	1491	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 6e 2d 68 65 61 64 2d 73 73 72 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 25 37 42 25 32 32 6c 61 6e 67 25 32 32 3a 25 37 42 25 32 32 73 73 72 25 32 32 3a 25 32 32 65 6e 25 32 32 25 37 44 25 37 44 22 3e 0a 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 28 32 29 20 50 65 6e 64 69 6e 67 20 44 6f 63 75 6d 65 6e 74 20 7c 20 41 63 63 65 73 73 20 44 6f 63 75 6d 65 6e 74 20 43 6c 6f 75 64 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html data-n-head-ssr lang="en" data-n-head="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D%7D"> <head > <title>(2) Pending Document \| Access Document Cloud</title><meta data-n-head="ssr" charset="utf-8"><meta data-n-head="ssr" name="viewpor
2022-04-20 12:56:44 UTC	1522	IN	Data Raw: 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 7d 0a 2e 73 68 61 64 6f 77 33 30 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 35 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 29 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 35 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 29 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 Data Ascii: rgba(0, 0, 0, 0.2); -moz-box-shadow: 0 1px 5px rgba(0, 0, 0, 0.2); box-shadow: 0 1px 5px rgba(0, 0, 0, 0.2);}.shadow30 { -webkit-box-shadow: 0 2px 5px 2px rgba(0, 0, 0, 0.3); -moz-box-shadow: 0 2px 5px 2px rgba(0, 0, 0, 0.3); box-shadow: 0 2p
2022-04-20 12:56:44 UTC	1554	IN	Data Raw: 20 20 20 20 20 20 0a 23 68 6c 5f 6d 61 69 6e 5f 70 6f 70 75 70 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 70 78 3b 0a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 67 72 61 79 29 3b 0a 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 30 70 78 3b 0a 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 68 69 74 65 29 3b 20 77 69 64 74 68 3a 37 32 30 70 78 3b 20 7d 20 0a 20 20 20 20 23 63 6f 6c 2d 38 70 38 39 67 34 54 Data Ascii: #hl_main_popup { padding-top: 20px;padding-bottom: 20px;padding-left: 20px;padding-right: 20px;margin-top: 0px;border-color: var(--gray);border-width: 10px;border-style: solid;background-color: var(--white); width:720px; } #col-8p89g4T
2022-04-20 12:56:44 UTC	1602	IN	Data Raw: 67 3a 31 72 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 72 65 6d 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6c 2d 61 70 70 20 2e 76 64 70 2d 64 61 74 65 70 69 63 6b 65 72 5f 5f 63 61 6c 65 6e 64 61 72 20 2e 63 65 6c 6c 2e 73 65 6c 65 63 74 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 31 38 38 62 66 36 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 68 6c 2d 61 70 70 20 2e 76 64 70 2d 64 61 74 65 70 69 63 6b 65 72 5f 5f 63 61 6c 65 6e 64 61 72 20 2e 63 65 6c 6c 2e 73 65 6c 65 63 74 65 64 2e 64 69 73 61 62 6c 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 64 64 64 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6c 2d 61 70 70 20 2e 68 6c 5f 65 76 65 Data Ascii: g:1rem!important;margin-bottom:3rem!important}.hl-app .vdp-datepicker__calendar .cell.selected{background:#188bf6!important;color:#fff}.hl-app .vdp-datepicker__calendar .cell.selected.disabled{background:#fff!important;color:#ddd!important}.hl-app .hl_eve
2022-04-20 12:56:45 UTC	1634	IN	Data Raw: 33 32 70 78 3b 68 65 69 67 68 74 3a 33 32 70 78 7d 2e 68 6c 2d 61 70 70 20 2e 6f 70 74 69 6f 6e 20 2e 6f 70 74 69 6f 6e 2d 6c 67 20 6c 61 62 65 6c 3a 61 66 74 65 72 7b 77 69 64 74 68 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 74 6f 70 3a 36 70 78 3b 6c 65 66 74 3a 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 72 65 6d 7d 2e 68 6c 2d 61 70 70 20 2e 6f 70 74 69 6f 6e 2d 72 61 64 69 6f 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 78 74 5d 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 31 65 31 65 31 3b 70 61 64 64 69 6e 67 3a 35 70 78 3b 77 69 64 74 68 3a 32 35 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 7d 2e 68 Data Ascii: 32px;height:32px}.hl-app .option .option-lg label:after{width:20px;height:20px;top:6px;left:6px;font-size:.75rem}.hl-app .option-radio input[type=text]{border:none;border-bottom:1px solid #e1e1e1;padding:5px;width:255px;border-radius:3px;background:0 0}.h
2022-04-20 12:56:45 UTC	1650	IN	Data Raw: 20 72 67 62 61 28 34 39 2c 34 39 2c 39 33 2c 2e 31 29 2c 30 20 31 70 78 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 38 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 77 69 64 74 68 3a 32 33 30 70 78 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 38 70 78 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 68 6c 2d 61 70 70 20 2e 70 61 79 66 6f 72 6d 20 2e 73 75 63 63 65 73 73 2e 76 69 73 69 62 6c 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 7d 2e 68 6c 2d 61 70 70 20 2e 70 61 79 66 6f 72 6d 20 2e 65 72 72 6f 72 7b 63 6f 6c 6f 72 3a 23 Data Ascii: rgba(49,49,93,.1),0 1px 2px 0 rgba(0,0,0,.08);border-radius:4px;border:0;margin-top:20px;font-size:15px;font-weight:400;width:230px;height:40px;line-height:38px;outline:none}.hl-app .payform .success.visible{display:inline}.hl-app .payform .error{color:#
2022-04-20 12:56:45 UTC	1682	IN	Data Raw: 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 61 75 74 6f 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6d 64 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 7b 77 69 64 74 68 3a 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 6f 70 61 63 69 74 79 3a 30 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 31 3b 77 69 6c 6c 2d 63 68 61 6e 67 65 3a 74 72 61 6e 73 66 6f 72 6d 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6d 64 3a 3a Data Ascii: center;align-items:center;overflow-y:auto}.appointment_widgets-md::-webkit-scrollbar{width:5px;position:absolute;top:0;left:0;border-radius:4px;background:#fff;opacity:0;cursor:default;outline:none;z-index:1;will-change:transform}.appointment_widgets-md::
2022-04-20 12:56:45 UTC	1714	IN	Data Raw: 69 6e 2d 74 6f 70 3a 30 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 78 6c 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 64 61 74 65 70 69 63 6b 2d 69 6e 66 6f 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 37 72 65 6d 3b 6c 65 66 74 3a 30 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 35 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 31 37 29 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 64 72 6f 70 2d 66 69 6c 74 65 72 3a 62 6c 75 72 28 33 70 Data Ascii: in-top:0}.appointment_widgets-xl .appointment_widgets--booking .appointment_widgets--steps .widgets-date-block .datepick-info{position:absolute;top:7rem;left:0;height:100%;width:100%;z-index:5;background:hsla(0,0%,100%,.17);-webkit-backdrop-filter:blur(3p
2022-04-20 12:56:45 UTC	1762	IN	Data Raw: 62 6c 61 63 6b 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6c 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 65 76 65 72 73 65 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 2d 72 65 76 65 72 73 65 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 Data Ascii: black-text-color);font-weight:700}.appointment_widgets-lg .appointment_widgets--booking{display:-webkit-box;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:reverse;flex-direction:column-reverse;height:100%;flex-direction:column}@media only
2022-04-20 12:56:45 UTC	1778	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 31 2e 33 72 65 6d 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 33 65 33 65 33 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6c 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 77 69 64 67 65 74 73 2d 61 63 74 69 6f 6e 2d 62 75 74 74 6f 6e 73 3e 64 Data Ascii: ay:flex;-webkit-box-align:center;align-items:center;padding:1.3rem;border-top:1px solid #e3e3e3;border-top:1px solid var(--appointment_widgets-border-color);border-bottom:none}.appointment_widgets-lg .appointment_widgets--booking .widgets-action-buttons>d
2022-04-20 12:56:46 UTC	1826	IN	Data Raw: 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 76 64 70 43 65 6c 6c 20 2e 76 64 70 43 65 6c 6c 43 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 36 64 36 64 36 3b 77 69 64 74 68 3a 35 35 70 78 3b 68 65 69 67 68 74 3a 35 35 70 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 Data Ascii: nt_widgets--booking .appointment_widgets--steps .widgets-date-block .vdpCell .vdpCellContent{position:relative;border:1px solid #d6d6d6;width:55px;height:55px;display:-webkit-box;display:flex;-webkit-box-align:center;align-items:center;-webkit-box-pack:ce
2022-04-20 12:56:46 UTC	1846	IN	Data Raw: 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 73 6d 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 64 61 74 65 2d 70 69 63 6b 65 72 2d 63 61 6c 65 6e 64 61 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 72 65 6d 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 73 6d 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 Data Ascii: ify-content:space-between}.appointment_widgets-sm .appointment_widgets--booking .appointment_widgets--steps .widgets-date-block .date-picker-calendar{margin-top:1rem}.appointment_widgets-sm .appointment_widgets--booking .appointment_widgets--steps .widget
2022-04-20 12:56:46 UTC	1878	IN	Data Raw: 64 65 46 72 6f 6d 4c 65 66 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 2e 35 65 6d 2c 30 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 2e 35 65 6d 2c 30 2c 30 29 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 76 64 70 53 6c 69 64 65 46 72 6f 6d 52 69 67 68 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2e 35 65 6d 2c 30 2c Data Ascii: deFromLeft{0%{opacity:0;-webkit-transform:translate3d(-.5em,0,0);transform:translate3d(-.5em,0,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes vdpSlideFromRight{0%{opacity:0;-webkit-transform:translate3d(.5em,0,
2022-04-20 12:56:46 UTC	1926	IN	Data Raw: 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e Data Ascii: ...--> ...--> ...--> ...--> ...--> ...--> ...--></div></div> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--></div></div> ...--> ...-->
2022-04-20 12:56:46 UTC	1958	IN	Data Raw: 70 3a 20 30 3b 5c 6e 20 20 62 6f 74 74 6f 6d 3a 20 30 3b 5c 6e 20 20 77 69 64 74 68 3a 20 31 2e 35 72 65 6d 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 39 39 39 39 70 78 3b 5c 6e 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 30 2e 32 35 72 65 6d 3b 5c 6e 5c 6e 20 20 72 69 67 68 74 3a 20 35 30 25 3b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 27 27 3b 5c 6e 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 3b 5c 6e 7d 5c 6e 5c 6e 2e 66 6f 72 6d 2d 73 77 69 74 63 68 2d 63 68 65 63 6b 62 6f 78 3a 63 68 65 63 6b 65 64 20 2b 20 2e 66 6f 72 6d 2d 73 77 69 74 63 68 2d 6c 61 62 65 6c 20 7b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 66 66 34 3b 5c 6e 20 20 62 6f 78 2d 73 68 61 Data Ascii: p: 0;\n bottom: 0;\n width: 1.5rem;\n border-radius: 9999px;\n margin-left: -0.25rem;\n\n right: 50%;\n content: '';\n transition: all 0.2s ease-in;\n}\n\n.form-switch-checkbox:checked + .form-switch-label {\n background-color: #f0fff4;\n box-sha
2022-04-20 12:56:46 UTC	1974	IN	Data Raw: 30 2c 20 30 2e 31 35 29 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 35 29 3b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 5c 6e 7d 5c 6e 2e 62 6f 72 64 65 72 34 20 7b 5c 6e 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 35 29 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 35 29 3b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 7d 5c 6e 2e 73 68 61 64 6f 77 31 20 7b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 30 70 78 20 36 70 78 20 2d 36 70 78 Data Ascii: 0, 0.15);\n border-bottom: 2px solid rgba(0, 0, 0, 0.15);\n padding: 5px;\n}\n.border4 {\n border: 1px solid rgba(0, 0, 0, 0.35);\n border-bottom: 2px solid rgba(0, 0, 0, 0.35);\n padding: 1px !important;\n}\n.shadow1 {\n box-shadow: 0 10px 6px -6px
2022-04-20 12:56:46 UTC	1990	IN	Data Raw: 6f 72 3a 7b 76 61 6c 75 65 3a 61 67 7d 7d 2c 77 72 61 70 70 65 72 3a 7b 7d 2c 63 75 73 74 6f 6d 43 73 73 3a 5b 5d 2c 69 64 3a 61 68 2c 63 68 69 6c 64 3a 5b 61 69 5d 2c 6d 65 74 61 3a 61 68 2c 74 69 74 6c 65 3a 22 50 6f 70 75 70 22 2c 74 61 67 3a 62 2c 75 70 64 61 74 65 64 3a 66 7d 2c 7b 69 64 3a 61 69 2c 74 79 70 65 3a 72 2c 63 68 69 6c 64 3a 5b 61 6a 5d 2c 63 6c 61 73 73 3a 7b 61 6c 69 67 6e 52 6f 77 3a 7b 76 61 6c 75 65 3a 41 7d 2c 62 6f 78 53 68 61 64 6f 77 3a 7b 76 61 6c 75 65 3a 65 7d 2c 62 6f 72 64 65 72 73 3a 7b 76 61 6c 75 65 3a 67 7d 2c 62 6f 72 64 65 72 52 61 64 69 75 73 3a 7b 76 61 6c 75 65 3a 68 7d 2c 72 61 64 69 75 73 45 64 67 65 3a 7b 76 61 6c 75 65 3a 65 7d 7d 2c 73 74 79 6c 65 73 3a 7b 70 61 64 64 69 6e 67 4c 65 66 74 3a 7b 75 6e 69 74 3a Data Ascii: or:{value:ag}},wrapper:{},customCss:[],id:ah,child:[ai],meta:ah,title:"Popup",tag:b,updated:f},{id:ai,type:r,child:[aj],class:{alignRow:{value:A},boxShadow:{value:e},borders:{value:g},borderRadius:{value:h},radiusEdge:{value:e}},styles:{paddingLeft:{unit:

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:43 UTC	1488	OUT	GET /v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: app.twilead.com
2022-04-20 12:56:44 UTC	1506	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Apr 2022 12:56:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 266086 Connection: close Vary: Accept-Encoding Link: <https://cdn.msgsndr.com/_preview/6be6dd1.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/a14acc7.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/26d7810.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/cb3348a.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/9f74505.js>; rel=preload; as=script, <https://cdn.msgsndr.com/_preview/7e27dcc.js>; rel=preload; as=script Accept-Ranges: none Vary: Accept-Encoding
2022-04-20 12:56:44 UTC	1507	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 6e 2d 68 65 61 64 2d 73 73 72 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 25 37 42 25 32 32 6c 61 6e 67 25 32 32 3a 25 37 42 25 32 32 73 73 72 25 32 32 3a 25 32 32 65 6e 25 32 32 25 37 44 25 37 44 22 3e 0a 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 28 32 29 20 50 65 6e 64 69 6e 67 20 44 6f 63 75 6d 65 6e 74 20 7c 20 41 63 63 65 73 73 20 44 6f 63 75 6d 65 6e 74 20 43 6c 6f 75 64 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html data-n-head-ssr lang="en" data-n-head="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D%7D"> <head > <title>(2) Pending Document \| Access Document Cloud</title><meta data-n-head="ssr" charset="utf-8"><meta data-n-head="ssr" name="viewpor
2022-04-20 12:56:44 UTC	1538	IN	Data Raw: 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 7d 0a 2e 73 68 61 64 6f 77 33 30 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 35 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 29 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 35 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 29 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 Data Ascii: rgba(0, 0, 0, 0.2); -moz-box-shadow: 0 1px 5px rgba(0, 0, 0, 0.2); box-shadow: 0 1px 5px rgba(0, 0, 0, 0.2);}.shadow30 { -webkit-box-shadow: 0 2px 5px 2px rgba(0, 0, 0, 0.3); -moz-box-shadow: 0 2px 5px 2px rgba(0, 0, 0, 0.3); box-shadow: 0 2p
2022-04-20 12:56:44 UTC	1570	IN	Data Raw: 20 20 20 20 20 20 0a 23 68 6c 5f 6d 61 69 6e 5f 70 6f 70 75 70 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 70 78 3b 0a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 67 72 61 79 29 3b 0a 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 30 70 78 3b 0a 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 68 69 74 65 29 3b 20 77 69 64 74 68 3a 37 32 30 70 78 3b 20 7d 20 0a 20 20 20 20 23 63 6f 6c 2d 38 70 38 39 67 34 54 Data Ascii: #hl_main_popup { padding-top: 20px;padding-bottom: 20px;padding-left: 20px;padding-right: 20px;margin-top: 0px;border-color: var(--gray);border-width: 10px;border-style: solid;background-color: var(--white); width:720px; } #col-8p89g4T
2022-04-20 12:56:44 UTC	1586	IN	Data Raw: 67 3a 31 72 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 72 65 6d 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6c 2d 61 70 70 20 2e 76 64 70 2d 64 61 74 65 70 69 63 6b 65 72 5f 5f 63 61 6c 65 6e 64 61 72 20 2e 63 65 6c 6c 2e 73 65 6c 65 63 74 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 31 38 38 62 66 36 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 68 6c 2d 61 70 70 20 2e 76 64 70 2d 64 61 74 65 70 69 63 6b 65 72 5f 5f 63 61 6c 65 6e 64 61 72 20 2e 63 65 6c 6c 2e 73 65 6c 65 63 74 65 64 2e 64 69 73 61 62 6c 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 64 64 64 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6c 2d 61 70 70 20 2e 68 6c 5f 65 76 65 Data Ascii: g:1rem!important;margin-bottom:3rem!important}.hl-app .vdp-datepicker__calendar .cell.selected{background:#188bf6!important;color:#fff}.hl-app .vdp-datepicker__calendar .cell.selected.disabled{background:#fff!important;color:#ddd!important}.hl-app .hl_eve
2022-04-20 12:56:45 UTC	1618	IN	Data Raw: 33 32 70 78 3b 68 65 69 67 68 74 3a 33 32 70 78 7d 2e 68 6c 2d 61 70 70 20 2e 6f 70 74 69 6f 6e 20 2e 6f 70 74 69 6f 6e 2d 6c 67 20 6c 61 62 65 6c 3a 61 66 74 65 72 7b 77 69 64 74 68 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 74 6f 70 3a 36 70 78 3b 6c 65 66 74 3a 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 72 65 6d 7d 2e 68 6c 2d 61 70 70 20 2e 6f 70 74 69 6f 6e 2d 72 61 64 69 6f 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 78 74 5d 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 31 65 31 65 31 3b 70 61 64 64 69 6e 67 3a 35 70 78 3b 77 69 64 74 68 3a 32 35 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 7d 2e 68 Data Ascii: 32px;height:32px}.hl-app .option .option-lg label:after{width:20px;height:20px;top:6px;left:6px;font-size:.75rem}.hl-app .option-radio input[type=text]{border:none;border-bottom:1px solid #e1e1e1;padding:5px;width:255px;border-radius:3px;background:0 0}.h
2022-04-20 12:56:45 UTC	1666	IN	Data Raw: 20 72 67 62 61 28 34 39 2c 34 39 2c 39 33 2c 2e 31 29 2c 30 20 31 70 78 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 38 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 77 69 64 74 68 3a 32 33 30 70 78 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 38 70 78 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 68 6c 2d 61 70 70 20 2e 70 61 79 66 6f 72 6d 20 2e 73 75 63 63 65 73 73 2e 76 69 73 69 62 6c 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 7d 2e 68 6c 2d 61 70 70 20 2e 70 61 79 66 6f 72 6d 20 2e 65 72 72 6f 72 7b 63 6f 6c 6f 72 3a 23 Data Ascii: rgba(49,49,93,.1),0 1px 2px 0 rgba(0,0,0,.08);border-radius:4px;border:0;margin-top:20px;font-size:15px;font-weight:400;width:230px;height:40px;line-height:38px;outline:none}.hl-app .payform .success.visible{display:inline}.hl-app .payform .error{color:#
2022-04-20 12:56:45 UTC	1698	IN	Data Raw: 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 61 75 74 6f 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6d 64 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 7b 77 69 64 74 68 3a 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 6f 70 61 63 69 74 79 3a 30 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 31 3b 77 69 6c 6c 2d 63 68 61 6e 67 65 3a 74 72 61 6e 73 66 6f 72 6d 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6d 64 3a 3a Data Ascii: center;align-items:center;overflow-y:auto}.appointment_widgets-md::-webkit-scrollbar{width:5px;position:absolute;top:0;left:0;border-radius:4px;background:#fff;opacity:0;cursor:default;outline:none;z-index:1;will-change:transform}.appointment_widgets-md::
2022-04-20 12:56:45 UTC	1730	IN	Data Raw: 69 6e 2d 74 6f 70 3a 30 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 78 6c 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 64 61 74 65 70 69 63 6b 2d 69 6e 66 6f 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 37 72 65 6d 3b 6c 65 66 74 3a 30 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 35 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 31 37 29 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 64 72 6f 70 2d 66 69 6c 74 65 72 3a 62 6c 75 72 28 33 70 Data Ascii: in-top:0}.appointment_widgets-xl .appointment_widgets--booking .appointment_widgets--steps .widgets-date-block .datepick-info{position:absolute;top:7rem;left:0;height:100%;width:100%;z-index:5;background:hsla(0,0%,100%,.17);-webkit-backdrop-filter:blur(3p
2022-04-20 12:56:45 UTC	1746	IN	Data Raw: 62 6c 61 63 6b 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6c 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 65 76 65 72 73 65 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 2d 72 65 76 65 72 73 65 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 Data Ascii: black-text-color);font-weight:700}.appointment_widgets-lg .appointment_widgets--booking{display:-webkit-box;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:reverse;flex-direction:column-reverse;height:100%;flex-direction:column}@media only
2022-04-20 12:56:45 UTC	1794	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 31 2e 33 72 65 6d 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 33 65 33 65 33 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 6c 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 77 69 64 67 65 74 73 2d 61 63 74 69 6f 6e 2d 62 75 74 74 6f 6e 73 3e 64 Data Ascii: ay:flex;-webkit-box-align:center;align-items:center;padding:1.3rem;border-top:1px solid #e3e3e3;border-top:1px solid var(--appointment_widgets-border-color);border-bottom:none}.appointment_widgets-lg .appointment_widgets--booking .widgets-action-buttons>d
2022-04-20 12:56:45 UTC	1810	IN	Data Raw: 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 76 64 70 43 65 6c 6c 20 2e 76 64 70 43 65 6c 6c 43 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 36 64 36 64 36 3b 77 69 64 74 68 3a 35 35 70 78 3b 68 65 69 67 68 74 3a 35 35 70 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 Data Ascii: nt_widgets--booking .appointment_widgets--steps .widgets-date-block .vdpCell .vdpCellContent{position:relative;border:1px solid #d6d6d6;width:55px;height:55px;display:-webkit-box;display:flex;-webkit-box-align:center;align-items:center;-webkit-box-pack:ce
2022-04-20 12:56:46 UTC	1862	IN	Data Raw: 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 73 6d 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 73 2d 64 61 74 65 2d 62 6c 6f 63 6b 20 2e 64 61 74 65 2d 70 69 63 6b 65 72 2d 63 61 6c 65 6e 64 61 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 72 65 6d 7d 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 73 6d 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 62 6f 6f 6b 69 6e 67 20 2e 61 70 70 6f 69 6e 74 6d 65 6e 74 5f 77 69 64 67 65 74 73 2d 2d 73 74 65 70 73 20 2e 77 69 64 67 65 74 Data Ascii: ify-content:space-between}.appointment_widgets-sm .appointment_widgets--booking .appointment_widgets--steps .widgets-date-block .date-picker-calendar{margin-top:1rem}.appointment_widgets-sm .appointment_widgets--booking .appointment_widgets--steps .widget
2022-04-20 12:56:46 UTC	1894	IN	Data Raw: 64 65 46 72 6f 6d 4c 65 66 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 2e 35 65 6d 2c 30 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 2e 35 65 6d 2c 30 2c 30 29 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 76 64 70 53 6c 69 64 65 46 72 6f 6d 52 69 67 68 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2e 35 65 6d 2c 30 2c Data Ascii: deFromLeft{0%{opacity:0;-webkit-transform:translate3d(-.5em,0,0);transform:translate3d(-.5em,0,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes vdpSlideFromRight{0%{opacity:0;-webkit-transform:translate3d(.5em,0,
2022-04-20 12:56:46 UTC	1910	IN	Data Raw: 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e Data Ascii: ...--> ...--> ...--> ...--> ...--> ...--> ...--></div></div> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--> ...--></div></div> ...--> ...-->
2022-04-20 12:56:46 UTC	1942	IN	Data Raw: 70 3a 20 30 3b 5c 6e 20 20 62 6f 74 74 6f 6d 3a 20 30 3b 5c 6e 20 20 77 69 64 74 68 3a 20 31 2e 35 72 65 6d 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 39 39 39 39 70 78 3b 5c 6e 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 30 2e 32 35 72 65 6d 3b 5c 6e 5c 6e 20 20 72 69 67 68 74 3a 20 35 30 25 3b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 27 27 3b 5c 6e 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 3b 5c 6e 7d 5c 6e 5c 6e 2e 66 6f 72 6d 2d 73 77 69 74 63 68 2d 63 68 65 63 6b 62 6f 78 3a 63 68 65 63 6b 65 64 20 2b 20 2e 66 6f 72 6d 2d 73 77 69 74 63 68 2d 6c 61 62 65 6c 20 7b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 66 66 34 3b 5c 6e 20 20 62 6f 78 2d 73 68 61 Data Ascii: p: 0;\n bottom: 0;\n width: 1.5rem;\n border-radius: 9999px;\n margin-left: -0.25rem;\n\n right: 50%;\n content: '';\n transition: all 0.2s ease-in;\n}\n\n.form-switch-checkbox:checked + .form-switch-label {\n background-color: #f0fff4;\n box-sha
2022-04-20 12:56:46 UTC	1995	IN	Data Raw: 30 2c 20 30 2e 31 35 29 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 35 29 3b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 5c 6e 7d 5c 6e 2e 62 6f 72 64 65 72 34 20 7b 5c 6e 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 35 29 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 33 35 29 3b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 7d 5c 6e 2e 73 68 61 64 6f 77 31 20 7b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 30 70 78 20 36 70 78 20 2d 36 70 78 Data Ascii: 0, 0.15);\n border-bottom: 2px solid rgba(0, 0, 0, 0.15);\n padding: 5px;\n}\n.border4 {\n border: 1px solid rgba(0, 0, 0, 0.35);\n border-bottom: 2px solid rgba(0, 0, 0, 0.35);\n padding: 1px !important;\n}\n.shadow1 {\n box-shadow: 0 10px 6px -6px
2022-04-20 12:56:46 UTC	2011	IN	Data Raw: 6f 72 3a 7b 76 61 6c 75 65 3a 61 67 7d 7d 2c 77 72 61 70 70 65 72 3a 7b 7d 2c 63 75 73 74 6f 6d 43 73 73 3a 5b 5d 2c 69 64 3a 61 68 2c 63 68 69 6c 64 3a 5b 61 69 5d 2c 6d 65 74 61 3a 61 68 2c 74 69 74 6c 65 3a 22 50 6f 70 75 70 22 2c 74 61 67 3a 62 2c 75 70 64 61 74 65 64 3a 66 7d 2c 7b 69 64 3a 61 69 2c 74 79 70 65 3a 72 2c 63 68 69 6c 64 3a 5b 61 6a 5d 2c 63 6c 61 73 73 3a 7b 61 6c 69 67 6e 52 6f 77 3a 7b 76 61 6c 75 65 3a 41 7d 2c 62 6f 78 53 68 61 64 6f 77 3a 7b 76 61 6c 75 65 3a 65 7d 2c 62 6f 72 64 65 72 73 3a 7b 76 61 6c 75 65 3a 67 7d 2c 62 6f 72 64 65 72 52 61 64 69 75 73 3a 7b 76 61 6c 75 65 3a 68 7d 2c 72 61 64 69 75 73 45 64 67 65 3a 7b 76 61 6c 75 65 3a 65 7d 7d 2c 73 74 79 6c 65 73 3a 7b 70 61 64 64 69 6e 67 4c 65 66 74 3a 7b 75 6e 69 74 3a Data Ascii: or:{value:ag}},wrapper:{},customCss:[],id:ah,child:[ai],meta:ah,title:"Popup",tag:b,updated:f},{id:ai,type:r,child:[aj],class:{alignRow:{value:A},boxShadow:{value:e},borders:{value:g},borderRadius:{value:h},radiusEdge:{value:e}},styles:{paddingLeft:{unit:

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:44 UTC	1489	OUT	GET /favicon.ico HTTP/1.1 Host: app.twilead.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: msgsndr_id=4035320a-beaa-4d97-bb42-15b9958c4caa
2022-04-20 12:56:44 UTC	1489	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Apr 2022 12:56:44 GMT Content-Type: image/x-icon Content-Length: 318 Connection: close Vary: Accept-Encoding X-GUploader-UploadID: ADPycdt-kHovMCrLBptyp9apVG4mSWL1jOIqdjfRy1h5Wq628Bv7zQLrHwOkCu-z5T_NNkJJZvfhxG_HlnehdIwSaaSxrQ Cache-Control: no-store Expires: Thu, 20 Apr 2023 12:56:44 GMT Last-Modified: Mon, 05 Apr 2021 18:39:13 GMT ETag: "11fb4799192313dd5474a343d9cc0a17" x-goog-generation: 1617647953669348 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 318 x-goog-hash: crc32c=HZXf9w== x-goog-hash: md5=EftHmRkjE91UdKND2cwKFw== x-goog-storage-class: MULTI_REGIONAL Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Type Access-Control-Expose-Headers: Range Access-Control-Expose-Headers: Content-Range Access-Control-Expose-Headers: X-From-Cache Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2022-04-20 12:56:44 UTC	1490	IN	Data Raw: 00 00 01 00 01 00 10 10 10 00 00 00 00 00 28 01 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 2f 2a 00 ff 84 00 00 b3 87 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 02 00 00 00 00 00 00 00 20 00 00 00 00 00 01 22 00 00 00 00 30 00 02 20 00 00 00 00 33 30 22 00 00 00 00 00 00 33 30 00 00 00 00 00 00 22 33 33 00 00 00 00 00 00 03 03 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff Data Ascii: (( /*W "0 30"30"330

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:56:46 UTC	1842	OUT	POST /6 HTTP/1.1 Host: m.stripe.com Connection: keep-alive Content-Length: 2876 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://m.stripe.network Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://m.stripe.network/inner.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:56:46 UTC	1843	OUT	Data Raw: 4a 54 64 43 4a 54 49 79 64 6a 49 6c 4d 6a 49 6c 4d 30 45 78 4a 54 4a 44 4a 54 49 79 61 57 51 6c 4d 6a 49 6c 4d 30 45 6c 4d 6a 49 77 4d 32 55 78 4d 32 56 6c 4e 6d 51 7a 59 54 52 6c 59 6d 59 79 5a 44 6b 7a 5a 57 51 78 4e 54 46 68 59 54 56 6a 59 54 46 6d 5a 69 55 79 4d 69 55 79 51 79 55 79 4d 6e 51 6c 4d 6a 49 6c 4d 30 45 78 4e 54 55 30 4c 6a 67 6c 4d 6b 4d 6c 4d 6a 4a 30 59 57 63 6c 4d 6a 49 6c 4d 30 45 6c 4d 6a 49 30 4c 6a 55 75 4e 44 49 6c 4d 6a 49 6c 4d 6b 4d 6c 4d 6a 4a 7a 63 6d 4d 6c 4d 6a 49 6c 4d 30 45 6c 4d 6a 4a 71 63 79 55 79 4d 69 55 79 51 79 55 79 4d 6d 45 6c 4d 6a 49 6c 4d 30 45 6c 4e 30 49 6c 4d 6a 4a 68 4a 54 49 79 4a 54 4e 42 4a 54 64 43 4a 54 49 79 64 69 55 79 4d 69 55 7a 51 53 55 79 4d 6e 52 79 64 57 55 6c 4d 6a 49 6c 4d 6b 4d 6c 4d 6a 4a Data Ascii: JTdCJTIydjIlMjIlM0ExJTJDJTIyaWQlMjIlM0ElMjIwM2UxM2VlNmQzYTRlYmYyZDkzZWQxNTFhYTVjYTFmZiUyMiUyQyUyMnQlMjIlM0ExNTU0LjglMkMlMjJ0YWclMjIlM0ElMjI0LjUuNDIlMjIlMkMlMjJzcmMlMjIlM0ElMjJqcyUyMiUyQyUyMmElMjIlM0ElN0IlMjJhJTIyJTNBJTdCJTIydiUyMiUzQSUyMnRydWUlMjIlMkMlMjJ
2022-04-20 12:56:46 UTC	1910	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Apr 2022 12:56:46 GMT Content-Length: 156 Connection: close set-cookie: m=92d5c1bf-2c15-45b5-a1a3-0b19dede3ab8d50ac6;Expires=Fri, 19-Apr-2024 12:56:46 GMT;Secure;HttpOnly; SameSite=None x-content-type-options: nosniff Access-Control-Allow-Origin: https://m.stripe.network Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Content-Type: application/json;charset=utf-8
2022-04-20 12:56:46 UTC	1910	IN	Data Raw: 7b 22 6d 75 69 64 22 3a 22 61 36 37 33 61 35 63 33 2d 39 61 62 37 2d 34 36 65 38 2d 38 33 30 38 2d 34 33 37 63 38 37 65 37 61 61 31 37 66 35 35 62 33 39 22 2c 22 67 75 69 64 22 3a 22 39 32 64 35 63 31 62 66 2d 32 63 31 35 2d 34 35 62 35 2d 61 31 61 33 2d 30 62 31 39 64 65 64 65 33 61 62 38 64 35 30 61 63 36 22 2c 22 73 69 64 22 3a 22 64 39 34 31 62 37 32 31 2d 64 31 65 61 2d 34 66 30 62 2d 62 65 65 32 2d 33 30 37 32 32 62 65 35 61 35 66 31 30 36 33 33 31 36 22 7d Data Ascii: {"muid":"a673a5c3-9ab7-46e8-8308-437c87e7aa17f55b39","guid":"92d5c1bf-2c15-45b5-a1a3-0b19dede3ab8d50ac6","sid":"d941b721-d1ea-4f0b-bee2-30722be5a5f1063316"}