Edit tour

Windows Analysis Report
https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA

Overview

General Information

Sample URL:	https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO
Analysis ID:	681715
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5304 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,2470946740852295294,5168925717496805832,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6328 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA HTTP/1.1Host: t.sidekickopen25.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /head-dlb/static-1.213/bundle.production.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /EmailUnsubscribeUI/static-1.4956/bundles/custom-quick-fetch.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /EmailUnsubscribeUI/static-1.4956/bundles/earlyRequester.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubspot-dlb/static-1.293/bundle.production.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /EmailUnsubscribeUI/static-1.4956/bundles/project.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /EmailUnsubscribeUI/static-1.4621/bundles/project.css HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /EmailUnsubscribeUI/static-1.4956/subscription-preferences-container.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emailsubscriptions/v1/manage-preferences/starter-sales?v=5&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&email=m.brown%40omni-lite.com&clienttimeout=15000 HTTP/1.1Host: api.hubspot.comConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Content-type: application/jsonOrigin: https://t.sidekickopen25.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /subscriptions/v1/preferences/sales-portal-information?d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&s=false&v=5&clienttimeout=15000 HTTP/1.1Host: api.hubspot.comConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Content-type: application/jsonOrigin: https://t.sidekickopen25.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /subscriptions/v1/preferences/redirect?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&v=5&product=sales&email=m.brown%40omni-lite.com&s=false HTTP/1.1Host: api.hubspot.comConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: https://t.sidekickopen25.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /StyleGuideUI/static-3.269/img/sprocket/favicon-32x32.png HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ui-fonts/static-1.222/fonts/AvenirNext-Demi.woff2 HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4621/bundles/project.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ui-fonts/static-1.222/fonts/AvenirNext-Regular.woff2 HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4621/bundles/project.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ui-fonts/static-1.222/fonts/AvenirNext-Medium.woff2 HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4621/bundles/project.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ui-fonts/static-1.222/fonts/AvenirNext-Bold.woff2 HTTP/1.1Host: static.hsappstatic.netConnection: keep-aliveOrigin: https://t.sidekickopen25.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4621/bundles/project.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: cbaa991b-69e8-40b1-89f5-8b3897a1f5ed.tmp.2.dr, 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://dns.google
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_window.js.0.dr, craw_background.js.0.dr, 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,2470946740852295294,5168925717496805832,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,2470946740852295294,5168925717496805832,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/subscription-preferences-container.js	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Bold.woff2	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4621/bundles/project.css	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/head-dlb/static-1.213/bundle.production.js	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/hubspot-dlb/static-1.293/bundle.production.js	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Regular.woff2	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Medium.woff2	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Demi.woff2	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/bundles/project.js	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/bundles/earlyRequester.js	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/bundles/custom-quick-fetch.js	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/StyleGuideUI/static-3.269/img/sprocket/favicon-32x32.png	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
static.hsappstatic.net	104.17.5.210	true	false	unknown
api.hubspot.com	104.19.154.83	true	false	high
accounts.google.com	142.250.203.109	true	false	high
t.sidekickopen25.com	104.18.9.240	true	false	unknown
clients.l.google.com	172.217.168.14	true	false	high
clients2.google.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/subscription-preferences-container.js	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Bold.woff2	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4621/bundles/project.css	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://api.hubspot.com/metrics/v1/frontend/send	false		high
https://api.hubspot.com/cartographer/v1/performance?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956	false		high
https://static.hsappstatic.net/head-dlb/static-1.213/bundle.production.js	false	Avira URL Cloud: safe	unknown
https://api.hubspot.com/cartographer/v1/rhumb?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956	false		high
https://static.hsappstatic.net/hubspot-dlb/static-1.293/bundle.production.js	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Regular.woff2	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Medium.woff2	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Demi.woff2	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/bundles/project.js	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/bundles/earlyRequester.js	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4956/bundles/custom-quick-fetch.js	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/StyleGuideUI/static-3.269/img/sprocket/favicon-32x32.png	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	cbaa991b-69e8-40b1-89f5-8b3897a1f5ed.tmp.2.dr, 7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com	7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	false		high
https://clients2.googleusercontent.com	7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	false		high
https://apis.google.com	7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	7b239693-ecf7-436d-b253-c63950ec4010.tmp.2.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.5.210	static.hsappstatic.net	United States	13335	CLOUDFLARENETUS	false
104.19.154.83	api.hubspot.com	United States	13335	CLOUDFLARENETUS	false
104.18.9.240	t.sidekickopen25.com	United States	13335	CLOUDFLARENETUS	false
172.217.168.14	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	681715
Start date and time:	2022-08-10 15:30:40 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@23/84@6/8
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2022 15:31:55.356436014 CEST	56591	53	192.168.2.6	8.8.8.8
Aug 10, 2022 15:31:55.384268999 CEST	53	56591	8.8.8.8	192.168.2.6
Aug 10, 2022 15:31:55.529851913 CEST	60350	53	192.168.2.6	8.8.8.8
Aug 10, 2022 15:31:55.555866957 CEST	53	60350	8.8.8.8	192.168.2.6
Aug 10, 2022 15:31:55.686875105 CEST	61116	53	192.168.2.6	8.8.8.8
Aug 10, 2022 15:31:55.711488008 CEST	53	61116	8.8.8.8	192.168.2.6
Aug 10, 2022 15:31:57.645528078 CEST	51194	53	192.168.2.6	8.8.8.8
Aug 10, 2022 15:31:57.665019989 CEST	53	51194	8.8.8.8	192.168.2.6
Aug 10, 2022 15:31:58.188687086 CEST	51666	53	192.168.2.6	8.8.8.8
Aug 10, 2022 15:31:58.210817099 CEST	53	51666	8.8.8.8	192.168.2.6
Aug 10, 2022 15:32:01.840154886 CEST	57037	53	192.168.2.6	8.8.8.8
Aug 10, 2022 15:32:01.867202997 CEST	53	57037	8.8.8.8	192.168.2.6

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:56 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:56 UTC	2	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-anetP3fxzMTAA1syGTswYw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 10 Aug 2022 13:31:56 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5700 X-Daystart: 23516 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-10 13:31:56 UTC	2	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 37 30 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 33 35 31 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5700" elapsed_seconds="23516"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-08-10 13:31:56 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-08-10 13:31:56 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:58 UTC	534	OUT	OPTIONS /emailsubscriptions/v1/manage-preferences/starter-sales?v=5&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&email=m.brown%40omni-lite.com&clienttimeout=15000 HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: content-type Origin: https://t.sidekickopen25.com Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:58 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:58 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close CF-Ray: 7389184a2a719b45-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800
2022-08-10 13:31:58 UTC	537	IN	Data Raw: 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 36 30 34 38 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 2d 75 72 69 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 63 64 6e 2d 63 67 69 2f 62 65 61 63 6f 6e 2f 65 78 70 65 63 74 2d 63 74 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 53 66 37 64 49 39 63 65 32 6d 72 64 59 42 32 2e 48 70 33 61 4b 79 32 61 31 37 45 30 6a 6e 77 64 34 44 63 79 4f 4a 61 52 31 52 49 2d 31 36 36 30 31 33 38 33 31 38 2d 30 2d 41 5a 57 6b 65 77 79 5a 62 7a 31 67 66 54 31 33 67 57 77 39 56 55 66 76 6f 68 6e 4f 53 52 71 37 2b 35 68 53 42 31 67 50 34 66 39 4c 42 74 46 30 32 63 56 43 79 6b Data Ascii: Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Timing-Allow-Origin: *Set-Cookie: __cf_bm=Sf7dI9ce2mrdYB2.Hp3aKy2a17E0jnwd4DcyOJaR1RI-1660138318-0-AZWkewyZbz1gfT13gWw9VUfvohnOSRq7+5hSB1gP4f9LBtF02cVCyk

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:58 UTC	535	OUT	OPTIONS /subscriptions/v1/preferences/sales-portal-information?d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&s=false&v=5&clienttimeout=15000 HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: content-type Origin: https://t.sidekickopen25.com Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:58 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:58 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close CF-Ray: 7389184a2f2568f8-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800
2022-08-10 13:31:58 UTC	539	IN	Data Raw: 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 36 30 34 38 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 2d 75 72 69 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 63 64 6e 2d 63 67 69 2f 62 65 61 63 6f 6e 2f 65 78 70 65 63 74 2d 63 74 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 34 54 79 6d 63 79 58 34 73 63 4e 65 4b 34 5f 7a 6a 45 6d 5a 45 52 45 38 72 4d 2e 6a 77 38 45 37 43 68 74 5a 38 4a 4d 64 66 35 4d 2d 31 36 36 30 31 33 38 33 31 38 2d 30 2d 41 5a 77 63 6b 52 53 68 6c 70 2b 34 6a 69 48 6e 69 4b 44 67 6a 2f 66 52 72 58 32 42 78 32 67 6f 66 38 43 61 61 58 52 70 2f 50 34 74 67 35 4d 50 53 73 49 34 34 30 Data Ascii: Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Timing-Allow-Origin: *Set-Cookie: __cf_bm=4TymcyX4scNeK4_zjEmZERE8rM.jw8E7ChtZ8JMdf5M-1660138318-0-AZwckRShlp+4jiHniKDgj/fRrX2Bx2gof8CaaXRp/P4tg5MPSsI440

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:58 UTC	540	OUT	GET /emailsubscriptions/v1/manage-preferences/starter-sales?v=5&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&email=m.brown%40omni-lite.com&clienttimeout=15000 HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-type: application/json Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:58 UTC	546	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:58 GMT Content-Type: application/json;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 7389184c1b556933-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Cache-Control: no-cache, no-store, no-transform, must-revalidate, max-age=0 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
2022-08-10 13:31:58 UTC	547	IN	Data Raw: 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 45 78 70 6f 73 65 2d 48 65 61 64 65 72 73 3a 20 78 2d 6c 61 73 74 2d 6d 6f 64 69 66 69 65 64 2d 74 69 6d 65 73 74 61 6d 70 2c 20 58 2d 48 75 62 53 70 6f 74 2d 4e 6f 74 46 6f 75 6e 64 2c 20 58 2d 48 53 2d 55 73 65 72 2d 52 65 71 75 65 73 74 2c 20 4c 69 6e 6b 2c 20 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 2c 20 58 2d 48 75 62 73 70 6f 74 2d 43 6f 72 72 65 63 74 2d 48 75 62 6c 65 74 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 4d 61 78 2d 41 67 65 3a 20 36 30 34 38 30 30 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 36 30 34 38 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 2d 75 72 69 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 63 64 6e 2d 63 67 Data Ascii: Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-HubletAccess-Control-Max-Age: 604800Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cg
2022-08-10 13:31:58 UTC	548	IN	Data Raw: 31 39 30 0d 0a 7b 22 70 6f 72 74 61 6c 55 6e 73 75 62 73 63 72 69 62 65 64 22 3a 66 61 6c 73 65 2c 22 73 75 62 73 63 72 69 70 74 69 6f 6e 73 22 3a 5b 7b 22 69 64 22 3a 34 34 33 37 35 36 33 32 2c 22 6e 61 6d 65 22 3a 22 4d 61 72 6b 65 74 69 6e 67 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4d 61 72 6b 65 74 69 6e 67 20 6f 66 66 65 72 73 20 61 6e 64 20 75 70 64 61 74 65 73 2e 22 2c 22 73 75 62 73 63 72 69 62 65 64 22 3a 74 72 75 65 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 63 68 61 6e 6e 65 6c 22 3a 6e 75 6c 6c 2c 22 69 6e 74 65 72 6e 61 6c 4e 61 6d 65 22 3a 22 4d 41 52 4b 45 54 49 4e 47 5f 49 4e 46 4f 52 4d 41 54 49 4f 4e 22 2c 22 6f 72 64 65 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 69 64 22 3a 34 34 34 30 35 Data Ascii: 190{"portalUnsubscribed":false,"subscriptions":[{"id":44375632,"name":"Marketing Information","description":"Marketing offers and updates.","subscribed":true,"category":null,"channel":null,"internalName":"MARKETING_INFORMATION","order":null},{"id":44405
2022-08-10 13:31:58 UTC	549	IN	Data Raw: 72 64 65 72 22 3a 6e 75 6c 6c 7d 5d 7d 0d 0a Data Ascii: rder":null}]}
2022-08-10 13:31:58 UTC	549	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:58 UTC	541	OUT	GET /subscriptions/v1/preferences/sales-portal-information?d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&s=false&v=5&clienttimeout=15000 HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-type: application/json Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:58 UTC	549	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:58 GMT Content-Type: application/json;charset=utf-8 Content-Length: 157 Connection: close CF-Ray: 7389184c18659ba6-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800
2022-08-10 13:31:58 UTC	550	IN	Data Raw: 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 36 30 34 38 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 2d 75 72 69 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 63 64 6e 2d 63 67 69 2f 62 65 61 63 6f 6e 2f 65 78 70 65 63 74 2d 63 74 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 58 2d 48 75 62 53 70 6f 74 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 2d 49 64 3a 20 32 30 39 38 62 64 64 31 2d 36 66 61 38 2d 34 34 31 34 2d 61 65 64 61 2d 31 62 65 37 61 39 31 62 32 62 35 38 0d 0a 58 2d 54 72 61 63 65 3a 20 32 42 31 42 46 34 38 34 34 31 31 37 36 38 46 46 46 35 36 46 39 33 46 42 44 41 44 37 36 45 32 36 42 45 41 45 31 32 39 43 44 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Timing-Allow-Origin: *X-HubSpot-Correlation-Id: 2098bdd1-6fa8-4414-aeda-1be7a91b2b58X-Trace: 2B1BF484411768FFF56F93FBDAD76E26BEAE129CD80000000000000000
2022-08-10 13:31:58 UTC	551	IN	Data Raw: 7b 22 63 6f 6d 70 61 6e 79 4e 61 6d 65 22 3a 22 43 79 62 65 72 20 4d 61 6e 61 67 65 64 20 53 65 72 76 69 63 65 73 2c 20 49 6e 63 2e 20 28 43 79 62 65 72 4d 53 49 29 22 2c 22 6c 6f 67 6f 55 72 6c 22 3a 22 22 2c 22 70 72 69 6d 61 72 79 43 6f 6c 6f 72 22 3a 22 23 34 32 35 62 37 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 43 6f 6c 6f 72 22 3a 22 22 2c 22 61 63 63 65 6e 74 43 6f 6c 6f 72 22 3a 22 23 34 32 35 62 37 36 22 2c 22 61 63 63 65 6e 74 32 43 6f 6c 6f 72 22 3a 22 22 7d Data Ascii: {"companyName":"Cyber Managed Services, Inc. (CyberMSI)","logoUrl":"","primaryColor":"#425b76","secondaryColor":"","accentColor":"#425b76","accent2Color":""}

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:58 UTC	542	OUT	GET /subscriptions/v1/preferences/redirect?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&v=5&product=sales&email=m.brown%40omni-lite.com&s=false HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:58 UTC	551	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:58 GMT Content-Type: application/json;charset=utf-8 Content-Length: 33 Connection: close CF-Ray: 7389184c6a01994a-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800
2022-08-10 13:31:58 UTC	552	IN	Data Raw: 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 36 30 34 38 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 2d 75 72 69 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 63 64 6e 2d 63 67 69 2f 62 65 61 63 6f 6e 2f 65 78 70 65 63 74 2d 63 74 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 58 2d 48 75 62 53 70 6f 74 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 2d 49 64 3a 20 38 61 63 35 64 35 36 38 2d 38 32 65 63 2d 34 38 32 66 2d 39 36 34 33 2d 36 35 34 37 37 31 38 32 62 61 31 31 0d 0a 58 2d 54 72 61 63 65 3a 20 32 42 38 37 39 31 38 37 32 45 30 36 44 38 46 37 32 33 33 39 44 41 34 42 35 32 39 34 33 37 41 37 36 39 46 32 33 46 39 43 44 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Timing-Allow-Origin: *X-HubSpot-Correlation-Id: 8ac5d568-82ec-482f-9643-65477182ba11X-Trace: 2B8791872E06D8F72339DA4B529437A769F23F9CD00000000000000000
2022-08-10 13:31:58 UTC	553	IN	Data Raw: 7b 22 73 68 6f 75 6c 64 52 65 64 69 72 65 63 74 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 22 7d Data Ascii: {"shouldRedirect":false,"url":""}

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:58 UTC	543	OUT	GET /StyleGuideUI/static-3.269/img/sprocket/favicon-32x32.png HTTP/1.1 Host: static.hsappstatic.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:58 UTC	544	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:58 GMT Content-Type: image/webp Content-Length: 450 Connection: close Age: 71958 Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=1386 Content-Disposition: inline; filename="favicon-32x32.webp" ETag: "b29cd4fae32431fd350ffa1394aa4ee6" Last-Modified: Tue, 19 Jul 2022 18:15:17 GMT Vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method Via: 1.1 3f3b012fad703fdac0f14efdb7b78b6e.cloudfront.net (CloudFront) X-Amz-Cf-Id: aAawDqg6PoB47DENsLxzByuxjlYEexrPaVzDyvaSCH0eCnKe1Pf81w== X-Amz-Cf-Pop: FRA56-P2 X-Cache: Hit from cloudfront x-amz-replication-status: COMPLETED x-amz-server-side-encryption: AES256 x-amz-version-id: 2Kgo_VjWCUS_X8ACwtW_q6zZIo_6lLzL CF-Cache-Status: HIT Expires: Thu, 10 Aug 2023 13:31:58 GMT Cache-Control: public, max-age=31536000 Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HqTie%2BFEOmZpvfpcPk2jphZy5zgLqK0HQIBKfOEAbEhR2wYKhDMRus4rXE%2F4ixxImnVbEaAHfxCZHOqANpCY64lort%2B2JFKVFLGEd1b88k%2FP9Iftyp1rqv9mapjUhUmqYk6tegiVFmc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
2022-08-10 13:31:58 UTC	545	IN	Data Raw: 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 3b 20 70 72 65 6c 6f 61 64 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 37 33 38 39 31 38 34 63 36 64 31 32 36 39 39 62 2d 46 52 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadServer: cloudflareCF-RAY: 7389184c6d12699b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-10 13:31:58 UTC	545	IN	Data Raw: 52 49 46 46 ba 01 00 00 57 45 42 50 56 50 38 4c ae 01 00 00 2f 1f c0 07 10 16 88 8d 24 29 92 fc 0e ef 5f b7 74 67 c1 3c 63 3e 33 a9 ff cd 82 02 00 00 c1 66 b6 cd db b6 91 6c db 4c 7e b2 ed a7 27 db b6 6d 26 db b6 c9 c0 6d db 46 74 db db 33 77 9f 18 07 09 20 f0 ef 7e f0 88 57 2d 9d e8 ca 7d 42 80 2e 42 d4 e6 bf 8c 63 2d 81 15 6e 40 03 bd df 05 ac 7d 54 7e 38 2d 11 e2 bb ec 92 5a c0 c3 6f d5 f1 02 30 ed 95 3f 9e 0b f0 5b ab b2 c9 0a 78 06 48 49 e5 9d f9 58 08 5d 7d 37 a6 ec e5 4e e4 e7 98 86 ba f5 2e 94 c1 2f ee 0c 83 0b 47 c9 b0 3f 5f 2a f1 cf ee 83 af ff 1b 02 63 35 58 0a bd 67 8e 2e e0 04 c7 ac 63 8c f5 40 0a 74 e1 df 09 3f f0 29 1b 98 9b aa 47 cf 72 5e e5 a1 8d 67 5e 7a f2 a0 e0 14 7a cb 0c 11 0d be fd ea 12 6e cd 4f 95 97 3b 32 5b 1a 82 c4 9b fc 36 cb Data Ascii: RIFFWEBPVP8L/$)_tg<c>3flL~'m&mFt3w ~W-}B.Bc-n@}T~8-Zo0?[xHIX]}7N./G?_*c5Xg.c@t?)Gr^g^zznO;2[6

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:59 UTC	553	OUT	POST /cartographer/v1/rhumb?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956 HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Content-Length: 309 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=gC987EuFjHNQ5gfXvLTTRX_0TcfvdNdcWRxhQN5dtSU-1660138318-0-AZ7HLP32ux/RFmvxRVK6OTCahmN9ZYG9zbQoLq6D/+4vOT7hQ5UkmyTUaZm/WLMRvqi8/ssO7Bx1PuXQ6fkK5es=
2022-08-10 13:31:59 UTC	554	OUT	Data Raw: 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 38 35 2e 30 2e 34 31 38 33 2e 31 32 31 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 64 61 74 61 70 6f 69 6e 74 73 22 3a 5b 7b 22 74 6f 22 3a 7b 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 65 6d 61 69 6c 22 2c 22 72 6f 75 74 65 22 3a 22 2f 65 6d 61 69 6c 22 2c 22 73 63 65 6e 61 72 69 6f 22 3a 22 73 75 62 73 63 72 69 70 74 69 6f 6e 73 20 6c 6f 61 64 65 64 22 7d 2c 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 77 61 73 48 69 64 64 65 6e 22 3a Data Ascii: {"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","datapoints":[{"to":{"pathname":"/email","route":"/email","scenario":"subscriptions loaded"},"status":"success","wasHidden":
2022-08-10 13:31:59 UTC	627	IN	HTTP/1.1 204 No Content Date: Wed, 10 Aug 2022 13:31:59 GMT Connection: close CF-Ray: 7389184fdb879966-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
2022-08-10 13:31:59 UTC	631	IN	Data Raw: 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 58 2d 48 75 62 53 70 6f 74 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 2d 49 64 3a 20 65 31 36 38 61 61 34 32 2d 64 32 65 38 2d 34 37 34 62 2d 62 31 35 34 2d 35 66 31 33 33 38 62 37 30 39 37 35 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 75 56 54 6c 79 25 32 42 33 4b 6e 49 71 55 4c 45 43 67 53 73 45 69 77 72 58 64 49 54 41 4b 33 54 6a 77 45 57 32 66 5a 39 39 44 69 36 25 32 46 67 75 71 44 6c 75 5a 4b 6c 41 79 37 7a 59 35 68 6f 36 32 76 72 5a 72 72 75 25 32 42 33 77 74 43 6c 4c 36 6d 68 76 50 6c 34 58 Data Ascii: Timing-Allow-Origin: *X-HubSpot-Correlation-Id: e168aa42-d2e8-474b-b154-5f1338b70975Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uVTly%2B3KnIqULECgSsEiwrXdITAK3TjwEW2fZ99Di6%2FguqDluZKlAy7zY5ho62vrZrru%2B3wtClL6mhvPl4X

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:59 UTC	554	OUT	GET /ui-fonts/static-1.222/fonts/AvenirNext-Demi.woff2 HTTP/1.1 Host: static.hsappstatic.net Connection: keep-alive Origin: https://t.sidekickopen25.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.hsappstatic.net/EmailUnsubscribeUI/static-1.4621/bundles/project.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:59 UTC	557	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:59 GMT Content-Type: application/font-woff2 Content-Length: 24632 Connection: close Access-Control-Allow-Origin: https://t.sidekickopen25.com Access-Control-Allow-Methods: GET Access-Control-Max-Age: 3000 Access-Control-Allow-Credentials: true x-amz-replication-status: COMPLETED Last-Modified: Fri, 31 Jan 2020 17:53:06 GMT ETag: "e89ad3b7b29f8e69ec2253c3a74bdc97" x-amz-version-id: 2zHl2iaVNPXr6Lp2kxp.UxAYG0DD8zAE Vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method X-Cache: Hit from cloudfront Via: 1.1 4ecd74dda94d7576e134fcdf16df8128.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DUS51-C1 X-Amz-Cf-Id: AGP8WOzJMu1Dgb46-ysedhfHxvFmZfpwxs7VCJ99mon436SxwUgcgQ== Age: 69701 CF-Cache-Status: HIT Expires: Thu, 10 Aug 2023 13:31:59 GMT Cache-Control: public, max-age=31536000 Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PxrNH%2FMxMJxWOP9xv42aOwyeQLdE9p%2BFUYTs6K2STEhfoRk1YleSpfKLCUieB10BpfEp1o9koE0jvJgxDClHHR18wtZO76L0yBoJejVCyS4FqR0%2FZggIaBnpqFuISjLgOWkhk4UKzX0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
2022-08-10 13:31:59 UTC	558	IN	Data Raw: 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 3b 20 70 72 65 6c 6f 61 64 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 37 33 38 39 31 38 35 30 39 65 38 62 39 32 30 35 2d 46 52 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadServer: cloudflareCF-RAY: 738918509e8b9205-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-10 13:31:59 UTC	558	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 60 38 00 10 00 00 00 01 1b 1c 00 00 5f d7 00 02 19 99 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b c6 12 06 60 16 8b 60 00 82 74 08 83 64 09 92 50 11 08 0a 82 fc 58 82 bd 2b 01 36 02 24 03 8b 50 0b 8b 54 00 04 20 05 ae 41 07 20 0c 84 2f 1b 86 f4 17 d8 36 eb 7a 60 dd 09 6c 9f bc 5e f5 6e 3a c0 a6 03 fb cb a5 e7 f2 3e a3 30 d5 f2 af 11 6f 9f 5c 40 b7 01 01 aa bc 9c 2f 2d fb ff ff 8c e3 86 8c 12 16 a8 db aa ea ef b9 6c 96 ae c4 ec 9a 15 6b 43 ae 82 82 94 c9 da 3a 89 e6 6a 29 ae aa 5c 6a 4c 74 dc 71 57 3c f1 42 c5 46 87 99 da b1 e2 83 84 f5 a7 15 d3 fc 8d 79 6d 4c 48 a1 50 3f 30 54 d2 45 6b 30 07 1e 91 ae 4e 3a 45 25 76 be 66 25 96 21 3a 41 d0 0d df 17 4b 68 ba c3 71 6d 78 bb 42 6c f2 05 1d 3d 60 78 48 96 42 06 Data Ascii: wOF2`8_``tdPX+6$PT A /6z`l^n:>0o\@/-lkC:j)\jLtqW<BFymLHP?0TEk0N:E%vf%!:AKhqmxBl=`xHB
2022-08-10 13:31:59 UTC	559	IN	Data Raw: 27 17 ec d1 49 7f 8b 29 a3 d1 2c 42 01 62 07 c6 6f db 4d 22 9f dd 51 6e d1 76 0b f1 6e 2d b9 b3 c6 b0 3c 1c 04 4e 2e 44 0b be df b5 40 ae d2 fd fd 43 87 b1 20 06 2f 1e a4 c7 07 2e 9f e6 a4 fb e2 01 82 ff 7f 4b 11 92 93 41 7a 71 59 7c 70 f2 15 0c eb c5 ff 1e 06 e8 26 f8 80 5d 98 2c c3 6b e4 0e ff e3 2b 3d 78 36 79 c0 34 db a9 51 64 7c 02 7f cf 4d 3f f1 ab 1c 6c 6d b2 89 bc 30 fe 5f b6 8c e4 92 2b 45 7d 0d aa b8 1b a7 9f 26 5b fe 75 df a1 98 ea a9 de 38 2c 6c 5a 8e 97 ab 69 a4 71 97 7e 5e 83 f8 85 10 da 96 d5 60 1d 1e de 2e 36 43 e5 a8 d0 e6 e5 1e 5f b4 c9 16 a2 b9 b5 62 d8 1e a9 85 fc 65 f9 bb ba 4a 4b b1 3e 56 a6 96 6b 8f 89 a3 9f 32 92 b5 76 0b d6 e8 ba 4d d2 de 34 63 e2 34 4b 39 98 d8 57 71 64 eb 69 2f 58 3b 4d a2 a0 5e 01 64 4e b9 03 04 1c 43 74 04 b1 Data Ascii: 'I),BboM"Qnvn-<N.D@C /.KAzqY\|p&],k+=x6y4Qd\|M?lm0_+E}&[u8,lZiq~^`.6C_beJK>Vk2vM4c4K9Wqdi/X;M^dNCt
2022-08-10 13:31:59 UTC	561	IN	Data Raw: 8b 1d 03 15 0c 81 2f 52 3b 8c a4 80 20 95 34 64 c0 57 ce fc 2a fc 6c 16 87 41 cd bd 12 34 1f 18 0c 8b e5 71 b4 bc 47 c1 77 60 82 51 3b 2e 4e 44 f0 59 a5 12 21 52 8e 66 5a 56 a2 d2 84 4e 06 fa cd 54 e5 e8 d4 86 67 9a 64 50 80 4d d2 1a a1 56 d8 bf ee 41 6a 46 ec 08 01 02 88 c0 b7 f6 64 fd 7b 67 e7 1f d0 3d 98 bb 0f e6 c0 2f 3a df be 3a 68 07 a3 06 05 57 73 bb 9c fc b5 da 34 99 4d 26 48 b2 40 92 05 92 ac 15 bb f4 2a a8 5a 2e 16 57 c2 28 d6 08 d7 c2 28 d9 08 37 22 70 8b d0 ee 18 2d 6b 0c ab 31 a6 c6 80 1a a3 39 62 46 ec 88 1d b1 e2 96 df 5e 9d d6 1f 4d 7f 39 85 e7 f1 af 78 29 5e 73 65 14 be 0b f5 d6 0f 2c 49 37 44 9d 14 a5 d3 48 e3 42 00 07 01 1c 04 70 10 82 93 8d 92 35 4a 53 94 1f 63 c8 43 73 a0 bb 96 29 95 96 2d a6 55 1a b7 98 51 69 5f 52 d0 94 4e 34 b8 1f Data Ascii: /R; 4dWlA4qGw`Q;.NDY!RfZVNTgdPMVAjFd{g=/::hWs4M&H@Z.W((7"p-k19bF^M9x)^se,I7DHBp5JScCs)-UQi_RN4
2022-08-10 13:31:59 UTC	562	IN	Data Raw: 04 74 b7 cb 36 82 1c 4b 6d e1 3f b1 ce c3 fa 49 3f 22 ce 80 c4 32 fb a1 3a 8e e6 16 eb 27 a3 ac 8e 51 10 58 b2 c5 df c6 0f 06 21 6e 9f f6 75 0f 59 af 69 16 25 79 86 94 b7 8c b1 3a 82 69 24 f2 40 3a 90 28 23 78 f5 d6 24 0e 7d 5d 12 88 c8 9f 09 b0 91 17 a5 44 90 44 d9 8f a6 eb 74 63 14 4f bb 29 c8 55 c7 de ef ea fd 3d c7 0d 6d 45 99 2d e9 0c 92 fa 08 12 7f b7 f7 1b 56 7f 75 a6 0f a3 7c 04 05 6b 05 6c 8b 35 53 41 13 90 76 84 d6 ff c4 a8 2e fa 86 31 62 ea 36 f0 37 34 77 7b a3 fa eb 22 2c 70 64 1e cc 03 a1 1a 76 7e a1 9c 81 0e 65 c8 4f 74 cf 55 e1 c5 1e de 9d f2 a3 ea aa 34 4f 2f 55 25 4e 92 92 44 b2 ba ef ab 25 02 fd 0d 27 22 23 be c7 98 ae c7 e2 62 28 15 04 5e 63 ba 18 ab 6a 2c 82 71 01 9d 15 35 f5 3c 03 19 b0 e7 e0 3e a5 b8 76 75 9f 10 9a 60 26 1a 45 56 81 Data Ascii: t6Km?I?"2:'QX!nuYi%y:i$@:(#x$}]DDtcO)U=mE-Vu\|kl5SAv.1b674w{",pdv~eOtU4O/U%ND%'"#b(^cj,q5<>vu`&EV
2022-08-10 13:31:59 UTC	563	IN	Data Raw: 16 d7 a5 b5 f3 95 29 df 4b 23 16 be 6e f0 23 c3 17 3b af ac 1e eb 87 9b 7b 74 f2 31 fc d8 84 ed 28 e6 35 35 e6 f5 b7 83 d6 c7 7a 5a 0c dd 20 3f f3 22 c9 2d c7 e3 c3 b1 08 76 ab a0 08 54 c5 4b 41 36 be e1 e1 7b 96 23 ec b7 58 6b 12 93 e0 c8 6a 8f df 35 c3 8b d8 15 a5 40 47 b4 72 54 ca 52 4f 29 09 23 ae 92 44 2c 90 31 ce 4a f7 d8 cb 58 ef 9e 22 70 69 5e 5a 1c f6 5b ac 35 49 43 f0 a9 56 3f 6d c4 db 62 c2 9d 16 ab 8b fb 6d 8e 69 80 d4 52 0f 03 f6 32 36 9c be c3 d5 a4 56 c9 88 84 62 e0 f6 e7 2e e8 45 b7 c5 2b de b2 95 6d f5 aa 27 b9 31 cc 52 e2 b2 5c e0 87 94 4c db 44 ab 4e 65 d2 fb 67 85 96 38 62 3b 76 2f b9 96 3d 6b 77 fa ac de 61 94 ee cd 23 93 27 27 0f 4f d1 64 44 85 89 71 a8 c7 88 85 37 1b 4c da 09 03 ac 02 47 68 a5 5d 32 dd 52 ac 79 62 7d 50 22 98 30 d5 Data Ascii: )K#n#;{t1(55zZ ?"-vTKA6{#Xkj5@GrTRO)#D,1JX"pi^Z[5ICV?mbmiR26Vb.E+m'1R\LDNeg8b;v/=kwa#''OdDq7LGh]2Ryb}P"0
2022-08-10 13:31:59 UTC	565	IN	Data Raw: 56 27 31 01 55 46 1e ea 33 da 37 8d 79 19 14 75 1d 37 bb 60 69 84 1b 60 38 13 06 b7 dd 36 70 ec 46 60 f7 8a 38 c2 13 a3 18 d1 8a 3b 1c fb d0 3b 63 a1 e9 f5 6f 4f c1 b0 8b 2e ef ba ca ec 08 65 6e 57 2b 5e f4 1c 5c 2b bd 28 c0 ea a0 98 59 fb ce aa e8 66 ba 4f 56 73 52 20 00 44 57 d7 f6 4b 6b ba 7f eb e8 2a 62 3e f7 86 61 3d d5 98 d8 38 2e 6f 3a 0b 6c 97 aa 81 d4 fc 49 15 e2 42 e4 f3 7c 6d df ab 68 be b2 39 e9 01 ee 01 e6 c4 c9 ce 19 2f 59 33 db 88 53 05 12 97 25 e0 09 fa 64 df b2 10 b0 20 8d 5e 42 b9 f4 af 48 a8 ff a2 b6 93 a5 fb 6f db 54 20 1f 9c ba 98 d0 13 99 d7 0c 84 11 c6 44 22 3f 25 26 67 0b 3a 0b 84 5c 63 e4 62 7d f5 66 fb 2d 31 4b ca c6 e3 00 f0 f8 a2 56 cd 19 95 a0 1c b7 82 06 eb 23 83 f0 23 27 fa 7c 8f 5d be b3 08 a7 5e 4e 35 5a 9d b7 c4 2a 61 5d Data Ascii: V'1UF37yu7`i`86pF`8;;coO.enW+^\+(YfOVsR DWKkb>a=8.o:lIB\|mh9/Y3S%d ^BHoT D"?%&g:\cb}f-1KV##'\|]^N5Za]
2022-08-10 13:31:59 UTC	566	IN	Data Raw: 60 d3 cc ee 5d 97 50 65 1b 40 d2 c2 3b ee e5 dd 98 3d 3f 9e 7c 5c 6e eb 7a c5 e9 f9 c2 ee 42 6f 7e a6 c3 6a 3b 4c ff dd 7b a3 40 2c ac cd 58 ec d5 ca de f0 18 67 34 6c 57 e1 57 61 a2 3c 98 16 ba 2c 6d df 3e 54 61 41 86 eb b3 80 68 0e 03 1b e5 68 b0 3b a3 de b6 df bd c2 3a 4a 18 4c 21 77 92 7f cb 44 38 73 83 0e 9d 64 31 fd 09 56 69 a2 c9 1f f7 7b 2f 05 76 e9 dc 44 3b 39 c9 cc a6 2f a0 22 1c 39 ad c3 2b 83 44 a7 63 1c c8 20 1f 67 fa 31 76 58 02 65 04 2b 4c 88 2d 32 fd 48 3a 67 b8 eb 73 65 18 52 d1 fb bc 90 6d 28 be 8a 43 ad 46 3b b2 b5 6a 6b 3a be 39 52 b5 50 b1 63 9e d2 5f 2a 98 22 25 3e 32 e0 82 b6 f2 f3 b7 60 fc 77 eb 08 d4 e8 b2 b3 99 c3 b6 b1 f8 3b 92 93 23 a4 f4 0b 64 ea 95 0a 5f d1 af 8e 5d 29 1d 62 8c bb 82 fd e5 f0 3c 2b 7a 00 b5 bd 29 31 4d b0 f2 Data Ascii: `]Pe@;=?\|\nzBo~j;L{@,Xg4lWWa<,m>TaAhh;:JL!wD8sd1Vi{/vD;9/"9+Dc g1vXe+L-2H:gseRm(CF;jk:9RPc_*"%>2`w;#d_])b<+z)1M
2022-08-10 13:31:59 UTC	567	IN	Data Raw: bb df 65 53 dc d4 6f f0 92 de a5 f9 70 5d 36 9d cd 9c e8 7d 66 ab 0e eb 72 c3 d6 8b 83 07 3b 30 32 4a d4 ab 87 e2 62 7d 62 b4 33 c5 d9 81 59 e2 e8 18 9b 32 3a 36 3c ca aa 8a b6 ce 96 dd 4d 2d 5b 18 c9 cb ae 7b 1c 7f ec 7f 34 be 6a ce 98 48 5a 13 82 74 e6 45 fc 05 5c 69 b7 58 80 74 b7 3c 44 c7 4d 87 87 98 28 51 5d 09 30 27 bf a6 52 6d 32 55 a9 0b 6a 32 2d 89 83 69 15 42 4d f3 91 6c 42 94 0b af a2 84 c9 02 21 99 cc f4 2a 2e 17 2d 94 20 59 28 20 03 a4 78 a2 89 ca 79 a3 ec a1 c7 07 46 9c 4d d0 6d 23 d0 19 28 9e 59 a4 32 e7 28 d4 79 b6 86 31 18 0f df dd 1b 62 28 65 91 6c 8b 06 b2 7f 10 90 f2 d3 c2 b1 57 ce 14 34 df 63 df d9 00 50 5d df ed 60 91 09 7f 2c 20 4a 96 ec 68 a5 4d df 75 d9 43 12 c9 42 e4 a7 6c a7 c2 68 2b fb 1a 66 ce 2c ae b0 ea 45 41 87 b6 94 22 95 Data Ascii: eSop]6}fr;02Jb}b3Y2:6<M-[{4jHZtE\iXt<DM(Q]0'Rm2Uj2-iBMlB!*.- Y( xyFMm#(Y2(y1b(elW4cP]`, JhMuCBlh+f,EA"
2022-08-10 13:31:59 UTC	569	IN	Data Raw: 59 70 06 48 3e 0b cc a6 f6 8c c0 a7 f4 cc 9d 9d 06 5b 97 36 6d 35 39 e7 a5 cd bc de 33 61 2b 16 16 83 4f 60 7c 18 ff c8 bd 7a c9 cb 45 2f 97 dc f3 fe 3f 6e fd 1e c2 56 c2 6a f4 07 55 fa e2 b5 07 84 07 85 4b f9 f6 d4 6d 6c 70 e4 94 9f 26 36 63 46 4d 7b 36 a7 95 4e ea 5f 50 f1 b8 c2 df 9d e8 46 46 df be 17 90 8f 83 e1 a9 28 9f 2f 65 a4 ad e4 87 e1 a1 38 f0 8c 5b fa cf e2 7f 70 af 57 bc f1 bc 81 77 a8 ab e7 2f 9a 9d 3e d2 94 c4 0c 08 d4 f4 7f ac 02 91 ee 46 0d 6b 0c c2 90 29 35 8b a4 3c 3b 33 9e e7 6a 1f ca d5 9b 43 ec 8f 58 27 87 d3 0a 7d 48 a5 bf 29 ce a7 62 7e 9d d4 8b ca 2f b0 18 45 a7 5f 07 93 e6 1d 6b ca 67 a9 a3 bc bc 42 56 4c ab 05 2a 4d b6 12 81 5e 5d 26 9e 03 73 8d 7a 33 17 4a 4b a5 e6 b0 59 b9 1e 3e 8d c6 f3 e4 b0 d8 b9 d4 34 e6 a2 8a 3b 13 e8 2c Data Ascii: YpH>[6m593a+O`\|zE/?nVjUKmlp&6cFM{6N_PFF(/e8[pWw/>Fk)5<;3jCX'}H)b~/E_kgBVL*M^]&sz3JKY>4;,
2022-08-10 13:31:59 UTC	570	IN	Data Raw: 2d e3 0f 91 d1 b1 7f d6 5f ef 95 f1 a7 d3 c6 33 99 ab 18 8c 55 af eb 8f ef a1 46 22 41 43 3b 6f 39 e9 8c 5f 7e 1e e8 a6 40 92 29 40 61 bf 34 16 7e 15 66 28 14 21 da ef ec 90 4e c3 0e ff fe ea 41 ae 88 b0 17 3f 25 59 1d c8 9d 1d 6f fa 4f c0 ff 1d c6 0f a0 2e 5e ec 6b 7f e0 6f 79 ae cf ca e8 92 fb b5 d5 fa 18 d2 3c 3a cd 63 d2 1e d2 5e 7e 07 8c 51 b0 e6 78 7d 15 2c 7e cd c4 57 9c 45 13 d8 fa 06 6b 32 33 95 84 a5 e0 cd 27 0e c6 df b0 f8 e0 cd 4e d2 3e 77 ca a4 2c e4 ab ef 64 48 cc 3e 34 73 80 22 5e f0 7e f4 3e 8f 6a d5 b3 55 7d 45 aa 61 7b ba 93 43 de 46 8f c6 19 c2 38 fc 27 8d 1c f5 b7 9c 1d bc 12 02 e5 f2 30 f8 e8 c4 5e c0 0e 3d 0e b3 79 88 7d 15 a4 f9 02 ba 5d 63 a3 0b 04 76 ba ed c1 04 7c d4 0b ed 31 bc 69 6a 08 b5 30 aa ac a1 d7 3a 93 5b 71 a5 3f ca 49 Data Ascii: -_3UF"AC;o9_~@)@a4~f(!NA?%YoO.^koy<:c^~Qx},~WEk23'N>w,dH>4s"^~>jU}Ea{CF8'0^=y}]cv\|1ij0:[q?I
2022-08-10 13:31:59 UTC	571	IN	Data Raw: fa ae 56 cd ec 9d 9c 22 71 ea ba b6 89 8b 38 5f 7d 0c f9 8c 74 8e fe f8 10 08 d4 8e ea ef b9 61 5a 7e c3 ea ad 87 43 b3 7c c8 b9 c9 0d c7 f2 9b e7 23 12 86 60 f9 16 d3 68 63 c3 ee 12 e8 8f cc 2e e6 3b dd fd 7d 57 1d f8 7a d8 a7 61 ac 99 ad ff 77 fb b9 95 32 38 8d b8 77 5f 36 ea 7a 36 af 52 f2 81 46 5a b7 61 d9 0a 9b a3 9b 11 52 5e cb cd ad 35 1c 5d b5 59 65 77 24 ac 85 a7 ea 22 d5 b9 90 15 67 ff 66 77 7a 35 1a 5c 1a 5e 2a 0f 46 0d 3c f6 d3 92 88 00 5b 1e 76 bd 07 58 2f 69 fa 66 67 b8 f3 32 3f 50 77 ac dc 58 d9 d8 49 56 95 89 34 30 5e e2 be 3b d0 ad db b0 33 b9 33 5e 53 89 cd 94 da 64 cc 38 50 e9 99 dd da 22 b7 fa 55 86 98 d4 b4 8e 27 26 ed b4 a6 b9 2b ec 2e 57 cc 96 5c 24 1c 22 7e ea a3 ad d7 30 6e ed 31 73 68 f8 a2 f3 10 62 3b 79 2b b4 df bc 01 55 db 0b Data Ascii: V"q8_}taZ~C\|#`hc.;}Wzaw28w_6z6RFZaR^5]Yew$"gfwz5\^*F<[vX/ifg2?PwXIV40^;33^Sd8P"U'&+.W\$"~0n1shb;y+U
2022-08-10 13:31:59 UTC	573	IN	Data Raw: b9 06 26 b6 a6 bc c2 4f f1 0c 93 c4 56 ce cc e4 7f 9a af c9 1c 59 31 9d d0 dc 98 6d 5d 72 55 02 2c 3a 29 ad dc 4f 23 7e 4b 9b ae c4 84 27 28 ec e4 c2 23 26 87 40 6b 21 f1 d7 5b 15 03 cb 6c a3 7e ee ac 71 5c fe 31 68 44 62 d9 01 de fe e1 94 9e e9 9a 93 a5 3d c2 07 97 fe e7 c2 19 16 41 5e 4a 40 af 92 77 ec c4 d2 64 f4 88 cd 83 a4 0d 33 f7 22 f9 7b 66 d4 9f 17 34 1c 79 61 34 f5 42 89 6d cf e3 38 6a e7 89 92 6d 5f e0 0a 79 52 ba 7f 98 07 94 c9 bd e0 30 7a 40 ea f7 0e f7 e2 4e 60 87 ee 01 ae 99 d5 42 3b 2e 2c b3 ab c6 94 85 c7 c9 6c b6 2f a4 65 41 d5 68 87 1c 1b 11 3a 2c ea 27 c0 de a1 7c 76 5b 97 16 66 ba 85 24 d6 f4 fa 16 da e7 ef 26 8c 9d e0 88 eb e2 81 e7 19 49 ad 7f 64 11 86 14 d3 46 5e 88 54 46 e0 c6 0b b4 4a 1a fc eb ae 76 ed f8 d4 9c de d2 33 9e bd 1b Data Ascii: &OVY1m]rU,:)O#~K'(#&@k![l~q\1hDb=A^J@wd3"{f4ya4Bm8jm_yR0z@N`B;.,l/eAh:,'\|v[f$&IdF^TFJv3
2022-08-10 13:31:59 UTC	574	IN	Data Raw: f3 f0 69 6a db ff 78 1a 62 34 ad 30 56 ff 5d eb 07 c2 70 9a eb f9 27 00 84 e9 a7 5d 07 ac 55 ff 24 46 02 d5 25 81 28 6a 5e c8 91 e2 b1 62 39 24 c5 3f 7b 63 f9 24 24 5b 2d 87 8d b5 a1 e4 46 88 bc 74 b2 d0 e3 53 6e b7 33 3f 11 b2 af 3f b9 ce ca 7d 2e 48 64 a1 eb 68 59 8b 29 34 3c ae 7e 4b 3f b3 1f b8 1e 58 0d bb 31 6e 21 fd 67 57 40 30 3a 67 9d 57 77 93 78 e6 9f 87 1e 22 76 9f 62 37 c4 8a 13 88 5d 53 31 90 fc 73 3c ee 1e 04 db 5e b4 dc ce 06 a7 4f 11 a8 69 48 51 96 26 0c 40 0d 2d e7 cf a3 06 0a c6 90 ae 43 a8 63 a3 85 65 01 09 15 bb ac 53 8a fe 07 49 82 59 92 3b 96 16 31 45 f6 48 d5 f0 0e 58 cb b8 45 b4 70 07 9a 98 15 61 9b c3 3c 2d 8a d2 3e b4 15 10 59 ca 85 0d 9e e3 68 c0 11 4d 06 63 dd bb 1c 5f 0d bf 7d 57 b2 c4 08 ff fe d4 fe c4 a5 7c f2 d5 9d 79 f8 66 Data Ascii: ijxb40V]p']U$F%(j^b9$?{c$$[-FtSn3??}.HdhY)4<~K?X1n!gW@0:gWwx"vb7]S1s<^OiHQ&@-CceSIY;1EHXEpa<->YhMc_}W\|yf
2022-08-10 13:31:59 UTC	575	IN	Data Raw: 61 c3 86 93 d7 fe c7 24 c1 54 72 37 16 9b fc ff 95 2e a4 36 05 99 ad 73 dc fb 94 76 70 d5 c0 c2 8b 4b 5d 5f bb 85 4b fd 48 b6 4e 91 27 8d 5e 94 c0 44 ca 86 c3 5a f9 f1 a5 3b 24 b2 54 be 44 f5 4d 9e ce ab 45 da 00 49 61 93 23 44 59 5b 4e f3 f8 41 0d cf 97 f8 7f 06 d4 5d 03 94 92 65 00 18 00 c0 cc 22 f2 d0 d8 00 09 ab 43 23 73 90 63 b7 56 a2 70 89 2f 2f c8 2f e3 b4 41 9f ab 49 86 d8 f5 0f 89 1d 54 14 a1 a6 39 4c 45 16 56 17 d2 e8 a7 99 05 e3 ce 23 0f 73 57 60 b7 b3 3a 64 59 1a ed 04 2c 02 8b 8f da 1d cc c2 4c bf e8 e0 0f 87 76 4f 16 ed fa 73 87 bb ab ff 70 d4 79 40 a0 d3 4b bc 68 3e cb 32 36 82 8d 96 43 c1 f3 e4 65 f8 db 8b 49 3f 69 73 29 9e 73 a7 13 ee 30 61 21 8d c9 b3 e3 43 c1 73 e9 bc c6 29 dd e6 94 d3 57 ea 0a 79 8b 6e 6c 3e 78 16 a4 79 de 18 02 70 c2 Data Ascii: a$Tr7.6svpK]_KHN'^DZ;$TDMEIa#DY[NA]e"C#scVp///AIT9LEV#sW`:dY,LvOspy@Kh>26CeI?is)s0a!Cs)Wynl>xyp
2022-08-10 13:31:59 UTC	577	IN	Data Raw: 6b 40 b4 a5 5d 77 cd 04 01 c1 0f e2 48 0d 32 86 de f5 8d 36 69 74 30 bc 6e 57 1d 82 78 36 dc a1 50 e3 8e 70 88 44 5e b1 2d 9f e3 18 e6 88 bb 83 ce d0 74 4a 6b 7a 5c 9c 4c 0c 7f cc 6d ff 97 78 40 30 9e f1 a0 ed fd 12 77 a9 d8 a1 1b ed 2d fb 20 f0 bc d1 b6 0e 47 a1 f4 b2 f9 5a e9 22 c7 e1 8e 5f 53 67 39 ed 29 c0 f8 4f 53 5d 54 d5 83 62 f3 2d df 5d 29 9e c4 e2 44 ce a0 b1 f0 c1 3e db 33 99 a4 8c cc 63 be 1f 56 fc 7f 58 07 35 b4 ca e9 72 7c 0c 9e 39 f2 d5 e3 e2 02 51 98 41 da 07 24 d0 66 e3 d6 f3 d0 fb f3 f9 3a 22 17 ec 5b e7 ec 3e 55 e0 38 68 a3 e8 a0 c4 7b 74 3b 07 14 5b 31 eb e8 c9 64 66 ed 53 66 b3 24 30 0b 02 8d 72 01 51 de 31 41 dc dd c2 7e ec 71 6c 07 2f 57 dc 28 33 b2 24 f5 79 9b 9f a4 f8 ed 4e 7d 3f 2c 75 9a 44 57 12 59 86 97 6a 71 51 c8 23 84 42 ef Data Ascii: k@]wH26it0nWx6PpD^-tJkz\Lmx@0w- GZ"_Sg9)OS]Tb-])D>3cVX5r\|9QA$f:"[>U8h{t;[1dfSf$0rQ1A~ql/W(3$yN}?,uDWYjqQ#B
2022-08-10 13:31:59 UTC	578	IN	Data Raw: 03 d2 d9 19 81 4c bd 22 73 5a a2 57 17 7d 18 98 a6 ff 68 f5 e0 bb 3f 9f 4d 22 f8 93 39 cb 42 f5 8a 23 f2 52 0e 2e d7 51 fb fd 12 d4 dd d4 93 e4 6a a7 e0 ca 83 1e 81 8b c0 be d2 9e 94 ab bb 69 a4 e9 f5 5e c1 e0 a1 21 d4 d8 1b 98 d1 ac 2b 85 a5 1b af 76 01 a3 03 87 a2 e4 6d 63 b0 d9 43 02 25 48 7e 98 30 a3 05 5e 35 8e c9 87 3d e5 9d 8a 06 59 ae e0 73 09 44 5a dc 59 8c e3 12 91 87 08 6e 88 e8 be 07 ce 88 f5 fe c2 30 fe 8b 28 34 aa e4 a8 14 3e f2 6e 6b 7d 9d 0a f8 2a be 4c 3f 7e e1 79 89 de 6b a1 00 c1 0f c8 71 8a 9b 4a 0a 92 e2 e7 e8 58 ea de f4 56 e3 94 17 c2 1e c0 61 1e d1 b8 28 61 3a c8 e2 fd e3 52 4d 41 79 75 bb eb 64 bb d4 53 59 98 1c da e2 8d 41 12 48 65 20 c1 0c b6 46 a7 53 d6 77 bb 13 12 02 93 b9 ed 74 e6 23 cf 52 32 b5 c5 b4 87 cc ee 44 66 b2 5d 32 Data Ascii: L"sZW}h?M"9B#R.Qji^!+vmcC%H~0^5=YsDZYn0(4>nk}*L?~ykqJXVa(a:RMAyudSYAHe FSwt#R2Df]2
2022-08-10 13:31:59 UTC	579	IN	Data Raw: ad 25 cc d2 e0 4b c8 08 51 b4 b5 cd cb 79 6d 46 76 93 ac 48 99 d0 39 df cd f2 2a 9a b5 0c a7 eb 9d d9 08 c5 a7 20 cc bb 86 3f 95 29 45 96 a0 d1 00 53 e2 73 a6 0c 53 d6 80 49 c5 d1 de 70 be db e4 db 17 0a cb 4d 19 f6 c9 37 e0 df 5b c7 3d 2c 0d 36 f1 98 a0 04 8d c6 d4 96 70 c2 29 c3 94 05 10 56 66 75 86 aa c9 d7 68 40 5b 73 ef c9 98 fa 34 35 02 ea 6a 93 fa ba fb 13 49 40 6b f9 0e 13 c0 aa 73 56 ad 39 43 3c bf ec a5 48 bd 69 3f 6f c5 a1 d9 9c 99 4a b7 c5 25 05 35 48 58 0c c9 75 09 59 30 86 4a 43 eb 13 f2 50 8e ac 9b a7 2f 93 59 e0 79 7e a4 90 ad 6c 2c ee 1a 2d ca d3 4d c8 6a 5f 89 c1 47 02 92 db a7 20 35 a6 de 9d 3b 4d f3 f4 92 1f 23 81 bd 19 48 53 e5 d1 68 4c 5d 98 d2 3c 1f 86 4d d6 2a 2d 36 03 a1 65 0c e4 0d 89 35 bb 23 eb 6f 3b 37 a4 43 f5 94 68 24 04 89 Data Ascii: %KQymFvH9* ?)ESsSIpM7[=,6p)Vfuh@[s45jI@ksV9C<Hi?oJ%5HXuY0JCP/Yy~l,-Mj_G 5;M#HShL]<M*-6e5#o;7Ch$
2022-08-10 13:31:59 UTC	581	IN	Data Raw: 1e ee fa 9e a6 57 7b a0 e3 f8 dd 4c ff fc f3 13 5b 87 cd ca 62 da e5 26 86 18 2f 10 68 05 3a e2 bc 13 7c ca 4f b0 58 f6 19 9e 28 3e 3c 3a 10 a1 0a b7 90 45 0c f4 cf af 81 c2 2d 64 8b 2e 20 27 14 d0 cf f1 51 3c ad 68 8c 02 d5 c6 44 5c 2a 74 0a 04 0c 7d ec 3b 1e 48 28 cf e8 2a d7 dc f7 f1 2a 80 cc 53 a7 1f 7c e7 f9 71 e9 8c 4e 46 d2 01 de be e1 63 2f d1 75 42 38 1a 00 0e 5a 13 4d 06 26 95 20 2b e4 87 ac 30 44 eb 87 e6 36 39 1f e6 21 03 f5 49 ee 8c 50 74 34 26 72 a1 a0 8a 68 83 c3 4c 18 11 bd 37 03 a4 a4 27 33 5a 6c 99 8f b9 d3 fe 15 9e 62 43 8b 8d 0c 6f 4d 1f e9 ce ff cc 54 c5 4a ea 04 31 3a 75 ee d8 05 05 9e 73 e6 31 2f 77 49 0b 79 ec 42 1c 5f 94 23 59 33 ed fb 3c cc f3 22 aa 0b b3 28 c8 49 79 bd 45 95 24 59 6b 39 12 12 d3 e5 8d e3 c8 96 f8 e4 12 45 49 25 Data Ascii: W{L[b&/h:\|OX(><:E-d. 'Q<hD\t};H(*S\|qNFc/uB8ZM& +0D69!IPt4&rhL7'3ZlbCoMTJ1:us1/wIyB_#Y3<"(IyE$Yk9EI%

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\08da1e64-3637-4380-b7d3-8c5cd602a0ae.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5cc30a16-5a23-460c-a5f9-cc44f0f1ad76.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\9772c1eb-d589-4936-b663-bde5f8b6d394.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2b99bd8e-9588-4301-8dcb-c663811e88c9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\713a4d07-1971-4519-8b52-78f540b3face.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7b239693-ecf7-436d-b253-c63950ec4010.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7b245a7b-e60e-4ee6-9a03-603dc92c4560.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8882b591-6f11-4947-8ba6-1dfb47a8af0c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\cbaa991b-69e8-40b1-89f5-8b3897a1f5ed.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\ac2d22ff-1422-47fa-8ef8-abb19ce162f4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\b2e05e66-f4f9-40ad-b0cc-3ee34d4b3013.tmp

C:\Users\user\AppData\Local\Temp\2bbbbb7f-b1dd-46f2-8262-8c9ccdb943ca.tmp

C:\Users\user\AppData\Local\Temp\61a922b5-a624-4a53-b9fb-8dfc2569690a.tmp

C:\Users\user\AppData\Local\Temp\scoped_dir5304_813557795\2bbbbb7f-b1dd-46f2-8262-8c9ccdb943ca.tmp

Windows Analysis Report
https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:56 UTC	1	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:56 UTC	2	OUT	Data Raw: 20 Data Ascii:
2022-08-10 13:31:56 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 10 Aug 2022 13:31:56 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-H4JCFlK3OewmUBb1FJErXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-H4JCFlK3OewmUBb1FJErXg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-10 13:31:56 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-08-10 13:31:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:32:09 UTC	661	OUT	POST /metrics/v1/frontend/send HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Content-Length: 501 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=gC987EuFjHNQ5gfXvLTTRX_0TcfvdNdcWRxhQN5dtSU-1660138318-0-AZ7HLP32ux/RFmvxRVK6OTCahmN9ZYG9zbQoLq6D/+4vOT7hQ5UkmyTUaZm/WLMRvqi8/ssO7Bx1PuXQ6fkK5es=
2022-08-10 13:32:09 UTC	662	OUT	Data Raw: 7b 22 64 61 74 61 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 68 75 62 73 70 6f 74 2e 63 6f 6d 2f 73 75 62 73 63 72 69 70 74 69 6f 6e 73 2f 76 31 2f 70 72 65 66 65 72 65 6e 63 65 73 2f 72 65 64 69 72 65 63 74 3f 68 73 5f 73 74 61 74 69 63 5f 61 70 70 3d 45 6d 61 69 6c 55 6e 73 75 62 73 63 72 69 62 65 55 49 26 68 73 5f 73 74 61 74 69 63 5f 61 70 70 5f 76 65 72 73 69 6f 6e 3d 31 2e 34 39 35 36 26 64 3d 41 42 69 64 54 6d 63 70 56 6a 46 6f 73 4f 6c 48 74 4a 70 47 53 52 74 38 36 53 58 71 56 77 34 65 2d 76 6d 58 6b 74 45 4e 32 71 51 72 68 61 79 78 7a 48 68 4a 74 42 56 57 50 31 6d 4d 38 71 70 6f 6d 4c 56 77 4b 5a 45 6e 6f 69 7a 78 71 44 4e 68 6c 61 73 77 6f 54 49 77 4f 38 77 73 70 67 4e 73 6c 31 42 47 64 71 4a 75 45 72 Data Ascii: {"datapoints":[{"url":"https://api.hubspot.com/subscriptions/v1/preferences/redirect?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuEr
2022-08-10 13:32:09 UTC	662	IN	HTTP/1.1 204 No Content Date: Wed, 10 Aug 2022 13:32:09 GMT Connection: close CF-Ray: 7389188eea715caa-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
2022-08-10 13:32:09 UTC	664	IN	Data Raw: 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 58 2d 48 75 62 53 70 6f 74 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 2d 49 64 3a 20 62 30 35 66 35 30 37 64 2d 39 30 31 63 2d 34 39 66 64 2d 61 66 64 62 2d 33 61 39 35 33 62 33 32 30 30 32 61 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 57 6c 4d 4b 54 35 51 71 36 38 44 55 68 6a 79 59 4b 34 41 69 77 63 59 4b 4f 49 77 32 42 75 74 25 32 42 61 52 56 39 62 70 67 34 25 32 42 72 52 72 42 34 6f 6c 45 6f 6d 56 63 36 73 61 7a 44 52 6b 31 63 57 65 6b 76 36 70 6d 4e 69 39 78 6d 34 73 56 33 62 69 49 51 30 68 77 Data Ascii: Timing-Allow-Origin: *X-HubSpot-Correlation-Id: b05f507d-901c-49fd-afdb-3a953b32002aReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WlMKT5Qq68DUhjyYK4AiwcYKOIw2But%2BaRV9bpg4%2BrRrB4olEomVc6sazDRk1cWekv6pmNi9xm4sV3biIQ0hw

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:32:10 UTC	664	OUT	OPTIONS /emailsubscriptions/v1/manage-preferences/starter-sales?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&v=5&s=false&email=m.brown%40omni-lite.com HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Accept: / Access-Control-Request-Method: PUT Access-Control-Request-Headers: content-type Origin: https://t.sidekickopen25.com Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:32:10 UTC	665	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:32:10 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close CF-Ray: 73891896f9dabbda-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800
2022-08-10 13:32:10 UTC	666	IN	Data Raw: 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 36 30 34 38 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 2d 75 72 69 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 63 64 6e 2d 63 67 69 2f 62 65 61 63 6f 6e 2f 65 78 70 65 63 74 2d 63 74 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 62 71 62 41 4a 6a 6b 31 72 66 56 53 42 58 6b 46 63 46 65 69 46 50 61 55 73 65 6a 61 76 63 54 5a 6e 35 5a 57 53 4d 54 54 4f 63 34 2d 31 36 36 30 31 33 38 33 33 30 2d 30 2d 41 54 31 66 52 58 64 67 6e 4c 75 49 41 78 4a 6c 59 66 76 44 51 6e 65 50 39 4a 5a 50 6d 52 79 79 74 35 54 6b 72 4d 72 49 6c 69 49 4f 74 4a 78 34 4b 78 49 53 36 42 Data Ascii: Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Timing-Allow-Origin: *Set-Cookie: __cf_bm=bqbAJjk1rfVSBXkFcFeiFPaUsejavcTZn5ZWSMTTOc4-1660138330-0-AT1fRXdgnLuIAxJlYfvDQneP9JZPmRyyt5TkrMrIliIOtJx4KxIS6B

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:32:10 UTC	667	OUT	PUT /emailsubscriptions/v1/manage-preferences/starter-sales?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA&v=5&s=false&email=m.brown%40omni-lite.com HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Content-Length: 78 Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 content-type: application/json Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=gC987EuFjHNQ5gfXvLTTRX_0TcfvdNdcWRxhQN5dtSU-1660138318-0-AZ7HLP32ux/RFmvxRVK6OTCahmN9ZYG9zbQoLq6D/+4vOT7hQ5UkmyTUaZm/WLMRvqi8/ssO7Bx1PuXQ6fkK5es=
2022-08-10 13:32:10 UTC	668	OUT	Data Raw: 7b 22 73 75 62 73 63 72 69 62 65 64 49 64 73 22 3a 5b 34 34 33 37 35 36 33 32 2c 34 34 34 30 35 32 32 34 5d 2c 22 61 6c 6c 53 75 62 73 63 72 69 70 74 69 6f 6e 49 64 73 22 3a 5b 34 34 33 37 35 36 33 32 2c 34 34 34 30 35 32 32 34 5d 7d Data Ascii: {"subscribedIds":[44375632,44405224],"allSubscriptionIds":[44375632,44405224]}
2022-08-10 13:32:11 UTC	668	IN	HTTP/1.1 204 No Content Date: Wed, 10 Aug 2022 13:32:11 GMT Connection: close CF-Ray: 738918986aec9bb6-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Cache-Control: no-cache, no-store, no-transform, must-revalidate, max-age=0 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800
2022-08-10 13:32:11 UTC	670	IN	Data Raw: 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 36 30 34 38 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 2d 75 72 69 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 63 64 6e 2d 63 67 69 2f 62 65 61 63 6f 6e 2f 65 78 70 65 63 74 2d 63 74 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 58 2d 48 75 62 53 70 6f 74 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 2d 49 64 3a 20 32 34 31 34 30 66 34 63 2d 35 39 62 35 2d 34 38 31 36 2d 62 35 36 35 2d 38 34 61 31 30 39 64 34 36 61 31 35 0d 0a 58 2d 54 72 61 63 65 3a 20 32 42 35 46 32 35 39 34 35 46 38 35 44 37 33 44 38 44 39 31 46 35 35 34 44 41 33 39 46 38 34 37 30 41 39 31 36 41 41 35 37 41 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Timing-Allow-Origin: *X-HubSpot-Correlation-Id: 24140f4c-59b5-4816-b565-84a109d46a15X-Trace: 2B5F25945F85D73D8D91F554DA39F8470A916AA57A0000000000000000

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:32:21 UTC	670	OUT	POST /metrics/v1/frontend/send HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Content-Length: 506 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=gC987EuFjHNQ5gfXvLTTRX_0TcfvdNdcWRxhQN5dtSU-1660138318-0-AZ7HLP32ux/RFmvxRVK6OTCahmN9ZYG9zbQoLq6D/+4vOT7hQ5UkmyTUaZm/WLMRvqi8/ssO7Bx1PuXQ6fkK5es=
2022-08-10 13:32:21 UTC	671	OUT	Data Raw: 7b 22 64 61 74 61 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 68 75 62 73 70 6f 74 2e 63 6f 6d 2f 65 6d 61 69 6c 73 75 62 73 63 72 69 70 74 69 6f 6e 73 2f 76 31 2f 6d 61 6e 61 67 65 2d 70 72 65 66 65 72 65 6e 63 65 73 2f 73 74 61 72 74 65 72 2d 73 61 6c 65 73 3f 68 73 5f 73 74 61 74 69 63 5f 61 70 70 3d 45 6d 61 69 6c 55 6e 73 75 62 73 63 72 69 62 65 55 49 26 68 73 5f 73 74 61 74 69 63 5f 61 70 70 5f 76 65 72 73 69 6f 6e 3d 31 2e 34 39 35 36 26 64 3d 41 42 69 64 54 6d 63 70 56 6a 46 6f 73 4f 6c 48 74 4a 70 47 53 52 74 38 36 53 58 71 56 77 34 65 2d 76 6d 58 6b 74 45 4e 32 71 51 72 68 61 79 78 7a 48 68 4a 74 42 56 57 50 31 6d 4d 38 71 70 6f 6d 4c 56 77 4b 5a 45 6e 6f 69 7a 78 71 44 4e 68 6c 61 73 77 6f 54 49 77 4f Data Ascii: {"datapoints":[{"url":"https://api.hubspot.com/emailsubscriptions/v1/manage-preferences/starter-sales?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO
2022-08-10 13:32:21 UTC	672	IN	HTTP/1.1 204 No Content Date: Wed, 10 Aug 2022 13:32:21 GMT Connection: close CF-Ray: 738918d99d0c994b-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
2022-08-10 13:32:21 UTC	673	IN	Data Raw: 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 58 2d 48 75 62 53 70 6f 74 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 2d 49 64 3a 20 62 66 37 38 31 62 36 33 2d 38 33 30 30 2d 34 65 31 30 2d 38 37 31 65 2d 38 63 39 34 63 66 33 65 37 32 31 38 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 4e 49 69 51 73 50 6c 72 43 32 7a 35 31 43 74 45 6b 79 35 50 4a 54 31 55 34 32 42 6d 68 48 32 73 31 4a 43 4b 4d 41 4e 55 38 53 52 5a 32 32 75 69 76 46 62 68 4f 39 51 25 32 42 64 58 58 37 51 36 47 75 64 77 77 25 32 46 47 76 33 42 43 49 6a 6f 67 4f 57 35 32 59 6d 55 59 Data Ascii: Timing-Allow-Origin: *X-HubSpot-Correlation-Id: bf781b63-8300-4e10-871e-8c94cf3e7218Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NIiQsPlrC2z51CtEky5PJT1U42BmhH2s1JCKMANU8SRZ22uivFbhO9Q%2BdXX7Q6Gudww%2FGv3BCIjogOW52YmUY

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:32:45 UTC	674	OUT	POST /cartographer/v1/performance?hs_static_app=EmailUnsubscribeUI&hs_static_app_version=1.4956 HTTP/1.1 Host: api.hubspot.com Connection: keep-alive Content-Length: 1439 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://t.sidekickopen25.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=gC987EuFjHNQ5gfXvLTTRX_0TcfvdNdcWRxhQN5dtSU-1660138318-0-AZ7HLP32ux/RFmvxRVK6OTCahmN9ZYG9zbQoLq6D/+4vOT7hQ5UkmyTUaZm/WLMRvqi8/ssO7Bx1PuXQ6fkK5es=
2022-08-10 13:32:45 UTC	675	OUT	Data Raw: 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 38 35 2e 30 2e 34 31 38 33 2e 31 32 31 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 64 61 74 61 70 6f 69 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 6c 6f 6e 67 74 61 73 6b 22 2c 22 64 61 74 61 22 3a 7b 22 6e 61 6d 65 22 3a 22 73 65 6c 66 22 2c 22 65 6e 74 72 79 54 79 70 65 22 3a 22 6c 6f 6e 67 74 61 73 6b 22 2c 22 73 74 61 72 74 54 69 6d 65 22 3a 34 36 33 31 2e 34 39 35 30 30 30 30 30 30 30 30 31 2c 22 64 75 72 61 74 69 6f 6e 22 3a 33 35 38 2e 36 Data Ascii: {"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","datapoints":[{"type":"longtask","data":{"name":"self","entryType":"longtask","startTime":4631.495000000001,"duration":358.6
2022-08-10 13:32:45 UTC	676	IN	HTTP/1.1 204 No Content Date: Wed, 10 Aug 2022 13:32:45 GMT Connection: close CF-Ray: 7389196d6c9a9b3f-FRA Access-Control-Allow-Origin: https://t.sidekickopen25.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer Access-Control-Allow-Methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD Access-Control-Expose-Headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet Access-Control-Max-Age: 604800 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
2022-08-10 13:32:45 UTC	677	IN	Data Raw: 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 58 2d 48 75 62 53 70 6f 74 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 2d 49 64 3a 20 35 31 32 65 39 36 31 38 2d 64 65 35 34 2d 34 34 39 61 2d 39 37 32 64 2d 63 61 31 36 63 62 32 30 32 66 31 37 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 45 6c 68 7a 67 45 4f 42 55 78 55 61 59 76 68 6c 30 6d 50 48 6e 37 36 51 62 45 67 63 70 48 57 6a 6f 6f 34 4e 79 31 36 6a 4d 51 56 75 65 45 70 57 6b 66 43 7a 47 52 67 4b 46 74 52 35 55 31 76 6a 39 4d 79 71 66 7a 7a 55 67 4e 41 52 6d 35 35 5a 32 25 32 46 63 7a 30 4e 64 Data Ascii: Timing-Allow-Origin: *X-HubSpot-Correlation-Id: 512e9618-de54-449a-972d-ca16cb202f17Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ElhzgEOBUxUaYvhl0mPHn76QbEgcpHWjoo4Ny16jMQVueEpWkfCzGRgKFtR5U1vj9MyqfzzUgNARm55Z2%2Fcz0Nd

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:57 UTC	51	OUT	GET /EmailUnsubscribeUI/static-1.4956/bundles/custom-quick-fetch.js HTTP/1.1 Host: static.hsappstatic.net Connection: keep-alive Origin: https://t.sidekickopen25.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:57 UTC	204	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:57 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: https://t.sidekickopen25.com Access-Control-Allow-Methods: GET Access-Control-Max-Age: 3000 Access-Control-Allow-Credentials: true x-amz-replication-status: COMPLETED Last-Modified: Tue, 19 Jul 2022 20:06:41 GMT ETag: W/"b2f8060c4a1a46185fffe10159eef3b5" x-amz-server-side-encryption: AES256 x-amz-version-id: wv4JIT_cwSolicm4mj6Fnz.imOh_W49s Vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method X-Cache: Hit from cloudfront Via: 1.1 6faa38f38a1fee24a829fec7c748876c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P2 X-Amz-Cf-Id: IMmI0VbjhMcZhD0y_YEPoFvfqou-c4LJsYgP7ktikEwvNi86HAH13A== Age: 1875093 CF-Cache-Status: HIT Expires: Thu, 10 Aug 2023 13:31:57 GMT Cache-Control: public, max-age=31536000 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VVGelfBmBH2lj%2Ftrx%2BBuuHJR%2FZhtwlrGslito4sn1MGWHqT56HlKSWbcASd%2F1cm2fggA5CqhwOl335RqfeoLjo5qavpH%2B9x1%2Fuctg7A3gQY7GIxouEU2%2BRlokG4zOj9ivsGnBZUi4mI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
2022-08-10 13:31:57 UTC	207	IN	Data Raw: 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 3b 20 70 72 65 6c 6f 61 64 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 37 33 38 39 31 38 34 36 61 62 63 66 39 31 33 36 2d 46 52 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadServer: cloudflareCF-RAY: 73891846abcf9136-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-10 13:31:57 UTC	207	IN	Data Raw: 66 36 63 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 65 5b 6e 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 72 29 3b 6f 2e 6c 3d 21 30 3b 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 6e 3d 5b 7b 6e 61 6d 65 3a 22 68 65 61 64 2d 64 6c 62 2f 62 75 6e 64 6c 65 2e 70 72 6f 64 75 63 74 69 6f 6e 2e 6a 73 22 2c 70 61 74 68 3a 22 68 65 61 64 2d 64 6c 62 2f 73 74 61 74 69 63 2d 31 2e 32 31 33 2f 62 75 6e 64 6c 65 2e 70 72 6f 64 75 63 74 69 6f 6e 2e 6a 73 22 Data Ascii: f6c!function(e){var t={};function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};e[n].call(o.exports,o,o.exports,r);o.l=!0;return o.exports}var n=[{name:"head-dlb/bundle.production.js",path:"head-dlb/static-1.213/bundle.production.js"
2022-08-10 13:31:57 UTC	211	IN	Data Raw: 72 22 29 7d 28 7b 77 64 4c 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 65 3d 22 5b 63 75 73 74 6f 6d 2d 71 75 69 63 6b 2d 66 65 74 63 68 5d 20 45 61 72 6c 79 20 72 65 71 75 65 73 74 20 6e 6f 74 20 66 6f 75 6e 64 22 3b 6c 65 74 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 63 6f 6e 73 74 20 72 3d 65 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 3e 2d 31 3f 22 26 63 6c 69 65 6e 74 74 69 6d 65 6f 75 74 3d 22 3a 22 3f 63 6c 69 65 6e 74 74 69 6d 65 6f 75 74 3d 22 3b 72 65 74 75 72 6e 21 74 7c 7c 65 2e 69 6e 64 65 78 4f 66 28 22 63 6c 69 65 6e 74 74 69 6d 65 6f 75 74 3d 22 29 3e 2d 31 3f 65 3a 65 2b 72 2b 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 68 61 73 4f Data Ascii: r")}({wdLr:function(e,t){!function(){const e="[custom-quick-fetch] Early request not found";let t={};function r(e,t){const r=e.indexOf("?")>-1?"&clienttimeout=":"?clienttimeout=";return!t\|\|e.indexOf("clienttimeout=")>-1?e:e+r+t}function n(e){return t.hasO
2022-08-10 13:31:57 UTC	214	IN	Data Raw: 78 74 72 61 48 65 61 64 65 72 73 2e 66 6f 72 45 61 63 68 28 65 3d 3e 7b 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 65 2e 68 65 61 64 65 72 2c 65 2e 76 61 6c 75 65 29 7d 29 3b 6e 2e 63 6f 6e 74 65 6e 74 54 79 70 65 26 26 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 6e 2e 63 6f 6e 74 65 6e 74 54 79 70 65 29 3b 74 5b 65 5d 3d 7b 66 69 6e 69 73 68 65 64 3a 21 31 2c 65 72 72 6f 72 3a 21 31 2c 65 72 72 6f 72 53 74 61 74 75 73 3a 22 22 2c 77 68 65 6e 46 69 6e 69 73 68 65 64 43 61 6c 6c 62 61 63 6b 73 3a 6e 2e 77 68 65 6e 46 69 6e 69 73 68 65 64 3f 5b 6e 2e 77 68 65 6e 46 69 6e 69 73 68 65 64 5d 3a 5b 5d 2c 6f 6e 45 72 72 6f 72 43 61 6c 6c 62 61 63 6b 73 3a 6e 2e 6f 6e 45 72 72 6f 72 3f 5b 6e Data Ascii: xtraHeaders.forEach(e=>{o.setRequestHeader(e.header,e.value)});n.contentType&&o.setRequestHeader("Content-type",n.contentType);t[e]={finished:!1,error:!1,errorStatus:"",whenFinishedCallbacks:n.whenFinished?[n.whenFinished]:[],onErrorCallbacks:n.onError?[n
2022-08-10 13:31:57 UTC	216	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-10 13:31:57 UTC	54	OUT	GET /EmailUnsubscribeUI/static-1.4621/bundles/project.css HTTP/1.1 Host: static.hsappstatic.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://t.sidekickopen25.com/email-unsubscribe/email?v=5&product=sales&email=m.brown%40omni-lite.com&s=false&d=ABidTmcpVjFosOlHtJpGSRt86SXqVw4e-vmXktEN2qQrhayxzHhJtBVWP1mM8qpomLVwKZEnoizxqDNhlaswoTIwO8wspgNsl1BGdqJuErGw8URxSbmDwr4103NC25pZ5GgGukxpTNUaJilLAf111htAJKll1TKNkA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-10 13:31:57 UTC	131	IN	HTTP/1.1 200 OK Date: Wed, 10 Aug 2022 13:31:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close x-amz-replication-status: COMPLETED Last-Modified: Tue, 05 Apr 2022 18:06:20 GMT ETag: W/"8a8b858723c33c4c97cd69bd245d9947" x-amz-server-side-encryption: AES256 x-amz-version-id: r3YUrlzDAISBJSGMWM3rCCLEgHjGhDx6 Vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method X-Cache: Hit from cloudfront Via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P2 X-Amz-Cf-Id: mWF3byJG2zV4ZrnAob4vmdr0h3h_OFv1BbzF1RGT4Nb2Gqg57423hQ== Age: 667683 CF-Cache-Status: HIT Expires: Thu, 10 Aug 2023 13:31:57 GMT Cache-Control: public, max-age=31536000 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qUMofsvbeJFc1Wfe8%2FOKwkQGXmn9nDe6rF71DICgPAY1f%2BAi%2F6Jsz3EIFP%2BatXe5WiyMTvhY2bvnu%2FHPdJL%2FZY%2FI0q6gMZFlFaDUiWR8IWC558xWaaFTmrKx%2BlhIr3%2Bb4CK6rJ577qg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 73891846afac9171-FRA
2022-08-10 13:31:57 UTC	133	IN	Data Raw: 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-10 13:31:57 UTC	135	IN	Data Raw: 34 38 30 0d 0a 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 76 65 6e 69 72 20 4e 65 78 74 20 57 30 32 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 68 73 61 70 70 73 74 61 74 69 63 2e 6e 65 74 2f 75 69 2d 66 6f 6e 74 73 2f 73 74 61 74 69 63 2d 31 2e 32 32 32 2f 66 6f 6e 74 73 2f 41 76 65 6e 69 72 4e 65 78 74 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 2c 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 68 73 61 70 70 73 74 61 74 69 63 2e 6e 65 74 2f 75 69 2d 66 6f 6e 74 73 2f 73 74 61 74 69 63 2d 31 2e 32 32 32 2f 66 6f 6e 74 73 2f 41 76 65 6e 69 72 4e 65 78 74 2d 52 65 67 75 6c 61 72 2e 77 6f Data Ascii: 480@font-face{font-display:swap;font-family:Avenir Next W02;src:url(https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Regular.woff2) format("woff2"),url(https://static.hsappstatic.net/ui-fonts/static-1.222/fonts/AvenirNext-Regular.wo
2022-08-10 13:31:57 UTC	137	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:31:47
Start date:	10/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff6220c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	2
Start time:	15:31:49
Start date:	10/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,2470946740852295294,5168925717496805832,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
Imagebase:	0x7ff6220c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low