Edit tour

Windows Analysis Report
Activity Statement for User 01Apr2024-30Apr2024.pdf

Overview

General Information

Sample name:	Activity Statement for User 01Apr2024-30Apr2024.pdf
Analysis ID:	1432277
MD5:	c35188fe30d1402ed3a95fd86e390d0e
SHA1:	b618d5ca0a2d7377c5f38cab054d56bc5818cbd5
SHA256:	49609a661ee7158464594fbf75ed0b8a9d3c828556eb8a492d9afaa3c5b2c770
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Connects to many different domains

HTML page contains hidden URLs or javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 6188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Activity Statement for User 01Apr2024-30Apr2024.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4512 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1712,i,17945822127698390932,11913859670726568771,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://in.xero.com/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1?utm_source=statementsPdfLink" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2008,i,4408813981360811890,12628688319291748054,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=9267&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1Host: bam.nr-data.netConnection: keep-aliveContent-Length: 204sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36content-type: text/plainAccept: */*Origin: https://in.xero.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://in.xero.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=c1b656af79b55f04

Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: http://apps.xero.com/
Source: chromecache_709.9.dr, chromecache_489.9.dr	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: chromecache_725.9.dr	String found in binary or memory: http://opensource.org/licenses/BSD-2-Clause
Source: chromecache_725.9.dr	String found in binary or memory: http://opensource.org/licenses/GPL-2.0
Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: chromecache_458.9.dr	String found in binary or memory: http://www.amazon.com/b/?&node=7253015011.
Source: chromecache_709.9.dr, chromecache_489.9.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: chromecache_709.9.dr, chromecache_489.9.dr	String found in binary or memory: http://www.day.com/jcr/cq/1.0
Source: chromecache_806.9.dr	String found in binary or memory: https://a.quora.com/qevents.js
Source: chromecache_651.9.dr	String found in binary or memory: https://ad.doubleclick.net
Source: chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_651.9.dr	String found in binary or memory: https://ade.googlesyndication.com
Source: chromecache_806.9.dr	String found in binary or memory: https://ads.nextdoor.com/public/pixel/ndp.js
Source: chromecache_804.9.dr, chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_825.9.dr, chromecache_651.9.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_804.9.dr, chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_825.9.dr, chromecache_651.9.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_807.9.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_806.9.dr	String found in binary or memory: https://apps.rokt.com/integrations/launcher.js
Source: chromecache_806.9.dr	String found in binary or memory: https://apps.rokt.com/store/js/gtm_wrapper.min.js
Source: chromecache_507.9.dr, chromecache_662.9.dr	String found in binary or memory: https://apps.xero.com/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://brandfolder.xero.com/8HSCTPAX/at/6zhk5qqcc5prk73rt7svp8/xero-terms-of-use-ca-uk-us.pdf
Source: chromecache_806.9.dr	String found in binary or memory: https://c.amazon-adsystem.com/aat/amzn.js
Source: chromecache_804.9.dr, chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_825.9.dr, chromecache_651.9.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Bank-feeds
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Cancel-a-subscription
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Changing-pricing-plan
Source: chromecache_507.9.dr, chromecache_662.9.dr	String found in binary or memory: https://central.xero.com/s/article/Convert-to-Xero
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Dispute-over-access-to-Xero
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Export-data-out-of-Xero
Source: chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Get-help-from-Xero-Support
Source: chromecache_585.9.dr	String found in binary or memory: https://central.xero.com/s/article/Privacy-at-Xero
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Purchase-a-Xero-subscription
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Reactivate-your-Xero-organisation
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/The-Xero-subscriber
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/article/Xero-Connected-Apps
Source: chromecache_507.9.dr, chromecache_662.9.dr	String found in binary or memory: https://central.xero.com/s/article/Xero-for-mobile
Source: chromecache_507.9.dr, chromecache_662.9.dr	String found in binary or memory: https://central.xero.com/s/article/Xero-subscriptions-and-billing
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/discussion-guidelines
Source: chromecache_870.9.dr	String found in binary or memory: https://central.xero.com/s/learning
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/topic/0TO1N0000017kmHWAQ/bank-accounts-feeds#business
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/topic/0TO1N0000017kmRWAQ/giving-people-access-to-xero#business
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://central.xero.com/s/topic/0TO1N0000017kqJWAQ/security#business
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_448.9.dr	String found in binary or memory: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZTA5Y2QyYWE
Source: chromecache_667.9.dr	String found in binary or memory: https://cw.addthis.com/t.gif?&pid=41&pidt=0&pdid=e09cd2aa-7185-40a5-bf74-4fc29b294347&cu=https%3A%2F
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://developers.google.com/terms/api-services-user-data-policy#additional-requirements-for-specif
Source: chromecache_821.9.dr	String found in binary or memory: https://dmp.truoptik.com/6d78f32846d8648c/sync.gif?fck=e09cd2aa-7185-40a5-bf74-4fc29b294347
Source: chromecache_448.9.dr	String found in binary or memory: https://dpm.demdex.net/ibs:dpid=903&dpuuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=
Source: chromecache_861.9.dr	String found in binary or memory: https://eb2.3lift.com/xuid?mid=3658&xuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&dongle=0cfd&gdpr=0&gdp
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/stan
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/business/mybills/production/apple-touch-icon.png
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/business/mybills/production/favicon.ico
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/business/mybills/production/favicon.png
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/business/mybills/production/main.0534d31874f9c55071ed.js
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/business/mybills/production/main.3cf9c16495486cc66bcb.css
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/common/react-dom/18.2.0/react-dom.min.js
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/common/react/18.2.0/react.min.js
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/identity/client/1.1.13/identity.js
Source: chromecache_424.9.dr	String found in binary or memory: https://edge.xero.com/style/xui/22.0.0/xui.min.css
Source: chromecache_806.9.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: chromecache_431.9.dr	String found in binary or memory: https://go.xero.com/api/intercom/workspaces/$
Source: chromecache_806.9.dr	String found in binary or memory: https://google.com
Source: chromecache_806.9.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_752.9.dr, chromecache_711.9.dr, chromecache_759.9.dr, chromecache_564.9.dr, chromecache_403.9.dr, chromecache_580.9.dr, chromecache_858.9.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1023673485/?random
Source: chromecache_576.9.dr, chromecache_567.9.dr, chromecache_551.9.dr	String found in binary or memory: https://gusto.com/go/bd/xero?utm_source=xero
Source: chromecache_821.9.dr	String found in binary or memory: https://idpix.media6degrees.com/orbserv/hbpix?pixId=69060&pcv=78&ptid=87&tpuv=01&tpu=e09cd2aa-7185-4
Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	String found in binary or memory: https://in.xero.com/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1?utm_source=statementsPdfLink)/S/URI
Source: chromecache_448.9.dr, chromecache_821.9.dr, chromecache_419.9.dr, chromecache_861.9.dr, chromecache_667.9.dr	String found in binary or memory: https://js.adsrvr.org/universal_pixel.1.1.0.js
Source: chromecache_870.9.dr	String found in binary or memory: https://login.xero.com/identity/user/login
Source: chromecache_667.9.dr	String found in binary or memory: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=e09cd2aa-71
Source: chromecache_419.9.dr	String found in binary or memory: https://mid.rkdms.com/bct?pid=02760a75-50e3-4c64-b77b-fb5fcd04e437&_ct=img&puid=e09cd2aa-7185-40a5-b
Source: chromecache_861.9.dr	String found in binary or memory: https://mid.rkdms.com/bct?pid=211f5e71-10d4-4933-8c11-c9798f096adc&_ct=img&puid=e09cd2aa-7185-40a5-b
Source: chromecache_861.9.dr	String found in binary or memory: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_con
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/evaluate/embed/www.xero.com
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/evaluate/www.xero.com
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/review/www.xero.com
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/reviews/63bed4ab2338b6d417b6a965
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/reviews/63bf03884d0773066a34ff00
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/reviews/63c03b9c2338b6d417b7f488
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/reviews/640d11074132c023a056981e
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/reviews/642c689ac0d0ca0649a9b779
Source: chromecache_500.9.dr, chromecache_506.9.dr	String found in binary or memory: https://nz.trustpilot.com/reviews/6437fa9599c5fd22b4ab852c
Source: chromecache_651.9.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_804.9.dr, chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_825.9.dr, chromecache_651.9.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_829.9.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_806.9.dr	String found in binary or memory: https://q.quora.com/_/ad/
Source: chromecache_383.9.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_829.9.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_806.9.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: chromecache_806.9.dr	String found in binary or memory: https://static.ads-twitter.com/uwt.js
Source: chromecache_825.9.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_825.9.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_807.9.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_821.9.dr	String found in binary or memory: https://su.addthis.com/red/usync?pid=11124&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347&url=https%3a%2f
Source: chromecache_829.9.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_807.9.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_448.9.dr	String found in binary or memory: https://tags.bluekai.com/site/5386?id=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&redi
Source: chromecache_419.9.dr	String found in binary or memory: https://tags.rd.linksynergy.com/rcs?ns=ttd&uid3=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_con
Source: chromecache_804.9.dr, chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_825.9.dr, chromecache_651.9.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_870.9.dr	String found in binary or memory: https://twitter.com/xero/
Source: chromecache_419.9.dr, chromecache_667.9.dr	String found in binary or memory: https://uipglob.semasio.net/tradedesk/1/get?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b29
Source: chromecache_431.9.dr	String found in binary or memory: https://widget.intercom.io/widget/
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_806.9.dr	String found in binary or memory: https://www.awin1.com/sread.img?tt=ns&tv=2&
Source: chromecache_806.9.dr	String found in binary or memory: https://www.dwin1.com/
Source: chromecache_806.9.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_807.9.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_807.9.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_807.9.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_651.9.dr	String found in binary or memory: https://www.google.com
Source: chromecache_807.9.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_653.9.dr, chromecache_829.9.dr, chromecache_493.9.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_757.9.dr	String found in binary or memory: https://www.google.com/recaptcha/enterprise/
Source: chromecache_806.9.dr, chromecache_825.9.dr, chromecache_651.9.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_804.9.dr, chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_825.9.dr, chromecache_651.9.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_651.9.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_807.9.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_653.9.dr, chromecache_829.9.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.
Source: chromecache_757.9.dr, chromecache_493.9.dr, chromecache_707.9.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
Source: chromecache_551.9.dr	String found in binary or memory: https://www.hubdoc.com/terms
Source: chromecache_825.9.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_650.9.dr	String found in binary or memory: https://www.quantcast.com/legal/license
Source: chromecache_387.9.dr, chromecache_533.9.dr	String found in binary or memory: https://www.redditstatic.com/ads/581d359d/pixel.js
Source: chromecache_806.9.dr	String found in binary or memory: https://www.redditstatic.com/ads/pixel.js
Source: chromecache_576.9.dr, chromecache_567.9.dr, chromecache_507.9.dr, chromecache_662.9.dr, chromecache_551.9.dr	String found in binary or memory: https://www.trustpilot.com/review/www.xero.com
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xe.com/legal/
Source: chromecache_506.9.dr	String found in binary or memory: https://www.xero.com/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/about/legal/partner-agreement/
Source: chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/about/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/about/legal/privacy/?escape=true
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/about/legal/terms/account-info-services/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/about/legal/terms/data-processing-terms/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/about/security/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/about/yodlee-terms/
Source: chromecache_560.9.dr, chromecache_691.9.dr, chromecache_401.9.dr, chromecache_701.9.dr, chromecache_827.9.dr, chromecache_415.9.dr, chromecache_700.9.dr, chromecache_411.9.dr, chromecache_693.9.dr	String found in binary or memory: https://www.xero.com/api/crm/v1
Source: chromecache_576.9.dr, chromecache_780.9.dr, chromecache_581.9.dr, chromecache_852.9.dr, chromecache_567.9.dr, chromecache_706.9.dr, chromecache_657.9.dr, chromecache_598.9.dr, chromecache_608.9.dr, chromecache_606.9.dr, chromecache_762.9.dr, chromecache_801.9.dr, chromecache_683.9.dr, chromecache_585.9.dr, chromecache_551.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/api/crm/v2
Source: chromecache_576.9.dr, chromecache_780.9.dr, chromecache_581.9.dr, chromecache_852.9.dr, chromecache_567.9.dr, chromecache_706.9.dr, chromecache_657.9.dr, chromecache_598.9.dr, chromecache_608.9.dr, chromecache_606.9.dr, chromecache_762.9.dr, chromecache_801.9.dr, chromecache_683.9.dr, chromecache_585.9.dr, chromecache_551.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/api/events/v1/
Source: chromecache_560.9.dr, chromecache_691.9.dr, chromecache_401.9.dr, chromecache_701.9.dr, chromecache_827.9.dr, chromecache_415.9.dr, chromecache_700.9.dr, chromecache_411.9.dr, chromecache_693.9.dr	String found in binary or memory: https://www.xero.com/api/signup/v1
Source: chromecache_576.9.dr, chromecache_780.9.dr, chromecache_581.9.dr, chromecache_852.9.dr, chromecache_567.9.dr, chromecache_706.9.dr, chromecache_657.9.dr, chromecache_598.9.dr, chromecache_608.9.dr, chromecache_606.9.dr, chromecache_762.9.dr, chromecache_801.9.dr, chromecache_683.9.dr, chromecache_585.9.dr, chromecache_551.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/api/signup/v2
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/au/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/au/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/au/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/au/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/au/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/au/try-now/manage-invoices/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/blog/security-noticeboard/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/ca/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/ca/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/ca/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/ca/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/ca/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/ca/try-now/manage-invoices/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/content/dam/xero/pdfs/legal/xero-privacy-notice-july-2020.pdf
Source: chromecache_551.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/content/dam/xero/pilot-images/opengraph/opengraph-xero.png
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/hk/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/hk/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/hk/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/hk/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/hk/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/hk/try-now/manage-invoices/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/id/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/id/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/id/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/id/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/id/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/id/try-now/manage-invoices/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/ie/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/ie/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/ie/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/ie/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/ie/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/ie/try-now/manage-invoices/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/legal/terms/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/my/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/my/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/my/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/my/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/my/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/my/try-now/manage-invoices/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/nz/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/nz/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/nz/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/nz/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/nz/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/nz/try-now/manage-invoices/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/ph/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/ph/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/ph/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/ph/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/ph/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/ph/try-now/manage-invoices/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/pricing-plans/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/sg/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/sg/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/sg/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/sg/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/sg/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/sg/try-now/manage-invoices/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/try-now/manage-invoices/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/uk/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/uk/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/uk/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/uk/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/uk/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/uk/try-now/manage-invoices/
Source: chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/us/
Source: chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/us/legal/privacy/
Source: chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/us/legal/terms/
Source: chromecache_551.9.dr, chromecache_656.9.dr, chromecache_681.9.dr	String found in binary or memory: https://www.xero.com/us/pricing-plans/
Source: chromecache_683.9.dr	String found in binary or memory: https://www.xero.com/us/pricing-plans/early/
Source: chromecache_801.9.dr	String found in binary or memory: https://www.xero.com/us/pricing-plans/established/
Source: chromecache_762.9.dr	String found in binary or memory: https://www.xero.com/us/pricing-plans/growing/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/us/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/us/try-now/manage-invoices/
Source: chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	String found in binary or memory: https://www.xero.com/za/
Source: chromecache_706.9.dr, chromecache_585.9.dr	String found in binary or memory: https://www.xero.com/za/legal/privacy/
Source: chromecache_780.9.dr, chromecache_656.9.dr	String found in binary or memory: https://www.xero.com/za/legal/terms/
Source: chromecache_551.9.dr	String found in binary or memory: https://www.xero.com/za/pricing-plans/
Source: chromecache_827.9.dr	String found in binary or memory: https://www.xero.com/za/signup/
Source: chromecache_870.9.dr	String found in binary or memory: https://www.xero.com/za/try-now/manage-invoices/
Source: chromecache_825.9.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50705
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50708
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50716
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50729
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 50923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 50911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50778
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 50915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 50893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 50562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50859
Source: unknown	Network traffic detected: HTTP traffic on port 50749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50851
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50863
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50862
Source: unknown	Network traffic detected: HTTP traffic on port 50543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50877
Source: unknown	Network traffic detected: HTTP traffic on port 50657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50879
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50874
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50873
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 50601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50888
Source: unknown	Network traffic detected: HTTP traffic on port 50555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50407
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50408
Source: unknown	Network traffic detected: HTTP traffic on port 50725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50401

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49815 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.winPDF@71/856@446/100

Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	Initial sample: https://in.xero.com/en1miguha2gjxspux1gc4hdwm3sglpkrbandwdo1?utm_source=statementspdflink
Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	Initial sample: https://in.xero.com/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1?utm_source=statementsPdfLink

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 19-12-09-055.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Activity Statement for User 01Apr2024-30Apr2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1712,i,17945822127698390932,11913859670726568771,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://in.xero.com/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1?utm_source=statementsPdfLink"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2008,i,4408813981360811890,12628688319291748054,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1712,i,17945822127698390932,11913859670726568771,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2008,i,4408813981360811890,12628688319291748054,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	Initial sample: PDF keyword /JS count = 0
Source: Activity Statement for User 01Apr2024-30Apr2024.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9shh061_pkd97l_47k.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9shh061_pkd97l_47k.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Activity Statement for User 01Apr2024-30Apr2024.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Activity Statement for User 01Apr2024-30Apr2024.pdf	0%	Virustotal		Browse

Source	Detection	Scanner	Label
https://s.company-target.com/s/sync?exc=lr	0%	URL Reputation	safe
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26064&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/	0%	Avira URL Cloud	safe
https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413	0%	Avira URL Cloud	safe
https://mid.rkdms.com/bct?pid=02760a75-50e3-4c64-b77b-fb5fcd04e437&_ct=img&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347	0%	Avira URL Cloud	safe
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://bam.nr-data.net/events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21646&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/	0%	Avira URL Cloud	safe
https://partners.tremorhub.com/sync?UIDM=7c305adb-e298-42d1-9636-4375d0a2692c	0%	Avira URL Cloud	safe
https://bam.nr-data.net/events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=169062&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/	0%	Avira URL Cloud	safe
https://bam.nr-data.net/events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=18937&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1	0%	Avira URL Cloud	safe
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=30029&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/	0%	Avira URL Cloud	safe
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=22063&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/	0%	Avira URL Cloud	safe
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2F&page_title=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US	0%	Avira URL Cloud	safe
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26996&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/	0%	Avira URL Cloud	safe
https://bam.nr-data.net/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=8717&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/&af=err,xhr,stn,ins,spa&be=27&fe=8646&dc=328&perf=%7B%22timing%22:%7B%22of%22:1714151674009,%22n%22:0,%22f%22:3,%22dn%22:3,%22dne%22:3,%22c%22:3,%22s%22:3,%22ce%22:3,%22rq%22:13,%22rp%22:27,%22rpe%22:47,%22di%22:313,%22ds%22:355,%22de%22:355,%22dc%22:8659,%22l%22:8662,%22le%22:8673%7D,%22navigation%22:%7B%7D%7D&fp=251&fcp=251	0%	Avira URL Cloud	safe
https://bam.nr-data.net/events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=15370&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/	0%	Avira URL Cloud	safe
https://mid.rkdms.com/bct?pid=02760a75-50e3-4c64-b77b-fb5fcd04e437&_ct=img&puid=e09cd2aa-7185-40a5-b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pacman-content-live.live.eks.hotjar.com	54.154.35.245	true	false	high
d2fashanjl7d9f.cloudfront.net	18.64.174.54	true	false	high
global.px.quantserve.com	192.184.68.134	true	false	high
segments.company-target.com	13.35.116.64	true	false	unknown
us-east-eb2.3lift.com	52.223.22.214	true	false	high
s.dsp-prod.demandbase.com	34.96.71.22	true	false	high
d20qwf0wrdtevy.cloudfront.net	108.157.173.58	true	false	high
platform.twitter.map.fastly.net	146.75.124.157	true	false	unknown
stats.g.doubleclick.net	74.125.26.157	true	false	high
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	3.215.173.78	true	false	high
t.co	104.244.42.69	true	false	high
cm.g.doubleclick.net	192.178.50.34	true	false	high
www.google.com	142.250.217.228	true	false	high
tracking.g2crowd.com	172.64.144.225	true	false	high
ut.linksynergy.com	34.98.67.3	true	false	high
id.rlcdn.com	35.244.154.8	true	false	high
q.quora.com	52.200.166.19	true	false	high
js.intercomcdn.com	13.226.52.4	true	false	high
match.adsrvr.org	52.223.40.198	true	false	high
static-cdn.hotjar.com	108.157.173.85	true	false	high
star-mini.c10r.facebook.com	157.240.14.35	true	false	high
d8ghbpr3r4dzt.cloudfront.net	18.66.255.103	true	false	high
s.twitter.com	104.244.42.195	true	false	high
dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	52.40.174.159	true	false	high
api-iam.intercom.io	54.165.219.129	true	false	high
d2ctznuk6ro1vp.cloudfront.net	18.239.225.85	true	false	high
d1ykf07e75w7ss.cloudfront.net	18.239.228.142	true	false	high
dualstack.reddit.map.fastly.net	151.101.193.140	true	false	unknown
reddit.map.fastly.net	151.101.1.140	true	false	unknown
googleads.g.doubleclick.net	192.178.50.34	true	false	high
td.doubleclick.net	192.178.50.34	true	false	high
ml314.com	34.117.77.79	true	false	unknown
partners-alb-1113315349.us-east-1.elb.amazonaws.com	18.215.83.155	true	false	high
match-us-east-1-ecs.sharethrough.com	52.206.13.146	true	false	high
wsky-live.live.eks.hotjar.com	52.50.39.109	true	false	high
mid.rkdms.com	3.234.43.148	true	false	unknown
fastly-tls12-bam.nr-data.net	162.247.243.29	true	false	unknown
dart.l.doubleclick.net	142.250.217.166	true	false	high
dg2iu7dxxehbo.cloudfront.net	18.64.168.121	true	false	high
adservice.google.com	142.250.64.226	true	false	high
spdc-global.pbp.gysm.yahoodns.net	76.13.32.146	true	false	unknown
insight.adsrvr.org	15.197.193.217	true	false	high
adobetarget.data.adobedc.net	63.140.39.22	true	false	unknown
scontent.xx.fbcdn.net	157.240.14.19	true	false	high
tag.demandbase.com	13.249.98.101	true	false	high
dmp.truoptik.com	104.17.127.254	true	false	unknown
script.hotjar.com	13.226.52.60	true	false	high
ara.paa-reporting-advertising.amazon	18.173.166.39	true	false	unknown
nexus-websocket-a.intercom.io	35.174.127.31	true	false	high
d2pbcviywxotf2.cloudfront.net	18.64.174.79	true	false	high
tag-logger.demandbase.com	13.32.87.20	true	false	high
pixel.tapad.com	34.111.113.62	true	false	high
widget.intercom.io	13.32.87.102	true	false	high
ad.doubleclick.net	142.251.35.230	true	false	high
js-agent.newrelic.com	162.247.243.39	true	false	high
aax-eu.amazon-adsystem.com	52.95.115.196	true	false	high
pacman-metrics-live.live.eks.hotjar.com	54.229.161.54	true	false	high
track2.securedvisit.com	54.234.5.56	true	false	unknown
dsum-sec.casalemedia.com	104.18.36.155	true	false	high
api.company-target.com	13.35.116.97	true	false	unknown
tags.srv.stackadapt.com	18.210.82.4	true	false	high
xerolimited.sc.omtrdc.net	63.140.39.22	true	false	unknown
widget.trustpilot.com	13.249.98.6	true	false	high
ib.anycast.adnxs.com	68.67.179.164	true	false	high
edge.gycpi.b.yahoodns.net	68.180.135.252	true	false	unknown
uipus.semasio.net	50.57.31.206	true	false	high
alb.reddit.com	unknown	unknown	false	high
static.ads-twitter.com	unknown	unknown	false	unknown
idpix.media6degrees.com	unknown	unknown	false	high
secure.adnxs.com	unknown	unknown	false	high
940320.fls.doubleclick.net	unknown	unknown	false	high
cm.everesttech.net	unknown	unknown	false	high
cw.addthis.com	unknown	unknown	false	high
rules.quantcount.com	unknown	unknown	false	unknown
static.hotjar.com	unknown	unknown	false	high
www.xero.com	unknown	unknown	false	high
ws.hotjar.com	unknown	unknown	false	high
www.redditstatic.com	unknown	unknown	false	high
js.adsrvr.org	unknown	unknown	false	high
s.company-target.com	unknown	unknown	false	unknown
9401320.fls.doubleclick.net	unknown	unknown	false	high
acdn.adnxs.com	unknown	unknown	false	high
pixel.rubiconproject.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
secure-gl.imrworldwide.com	unknown	unknown	false	high
bam.nr-data.net	unknown	unknown	false	unknown
s.yimg.com	unknown	unknown	false	high
uipglob.semasio.net	unknown	unknown	false	high
partners.tremorhub.com	unknown	unknown	false	unknown
sp.analytics.yahoo.com	unknown	unknown	false	high
a.quora.com	unknown	unknown	false	high
s.go-mpulse.net	unknown	unknown	false	unknown
w3-reporting-nel.reddit.com	unknown	unknown	false	high
match.sharethrough.com	unknown	unknown	false	high
product-analytics-bff.xero.com	unknown	unknown	false	high
d.agkn.com	unknown	unknown	false	high
xerolimited.tt.omtrdc.net	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	high
aa.agkn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://9401320.fls.doubleclick.net/activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	false		high
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26064&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/	false	Avira URL Cloud: safe	unknown
https://mid.rkdms.com/bct?pid=02760a75-50e3-4c64-b77b-fb5fcd04e437&_ct=img&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347	false	Avira URL Cloud: safe	unknown
https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	false		high
https://9401320.fls.doubleclick.net/activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	false		high
https://9401320.fls.doubleclick.net/activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	false		high
https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEO6pjxdnwkaUlkGBLOOtw0U&sInitiator=internal&google_cver=1&google_cver=1	false		high
https://w3-reporting-nel.reddit.com/reports	false		high
about:blank	false	Avira URL Cloud: safe	low
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad	false		high
https://xero.demdex.net/event?d_dil_ver=9.4&_ts=1714151611653	false		high
https://ad.doubleclick.net/activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	false		high
https://mid.rkdms.com/bct?pid=437ea0fb-a4b9-4984-a0a2-8cbfec2ccecc&puid=cce91c92ed659663e5c02bfbce595320&sha256=7ce3f6ced5cb6000d9a64547418ef36a1e1120666513a68c874bf00e643ef69b&sha1=36b9ae06c3bb2a08fe12ef798c0b97abcee8d7ed&probflag=1&score=0.07526959&_ct=img	false		unknown
https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151742192&i=gtm&dwt=14&ive=webkitHidden	false		high
https://9401320.fls.doubleclick.net/activityi;dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	false		high
https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413	false	Avira URL Cloud: safe	unknown
https://bam.nr-data.net/events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21646&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/	false	Avira URL Cloud: safe	unknown
https://js-agent.newrelic.com/spa-aggregate.e6b09d52-1.236.0.min.js	false		high
https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151608035&i=gtm&dwt=9671&ive=blur	false		high
https://partners.tremorhub.com/sync?UIDM=7c305adb-e298-42d1-9636-4375d0a2692c	false	Avira URL Cloud: safe	unknown
https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/signup/	false		high
https://js.adsrvr.org/up_loader.1.1.0.js	false		high
https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY	false		high
https://bam.nr-data.net/events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=169062&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/	false	Avira URL Cloud: safe	unknown
https://script.hotjar.com/modules.25f289cf2c430c5f1dfb.js	false		high
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai	false		high
https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A38%20GMT&n=-2d&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm	false		high
https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/	false		high
https://dpm.demdex.net/id?d_visid_ver=5.0.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=C593280E560020957F000101%40AdobeOrg&d_nsid=0&d_mid=03549638624246876723885913874856506827&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&ts=1714151586550	false		high
https://9401320.fls.doubleclick.net/activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	false		high
https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	false		high
https://adservice.google.com/ddm/fls/z/dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F	false		high
https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151624141&i=gtm&dwt=42&ive=blur	false		high
https://9401320.fls.doubleclick.net/activityi;dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	false		high
https://bam.nr-data.net/events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=18937&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1	false	Avira URL Cloud: safe	unknown
https://js.intercomcdn.com/tooltips-modern.41f34148.js	false		high
https://alb.reddit.com/rp.gif?ts=1714151589122&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=	false		high
https://match.adsrvr.org/track/cmf/generic?ttd_pid=yjn0gup	false		high
https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs&host=https%3A%2F%2Fwww.xero.com&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY	false		high
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=e09cd2aa-7185-40a5-bf74-4fc29b294347&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad	false		high
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660500&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&rqm=FGET	false		high
https://ad.doubleclick.net/activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	false		high
https://tags.rd.linksynergy.com/rcs?ns=ttd&uid3=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3D1i071nc	false		high
https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696487&i=gtm&dwt=79&ive=blur	false		high
https://alb.reddit.com/rp.gif?ts=1714151690436&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=	false		high
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=30029&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/	false	Avira URL Cloud: safe	unknown
https://api-iam.intercom.io/messenger/web/ping	false		high
https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals	false		high
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=22063&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/	false	Avira URL Cloud: safe	unknown
https://pixel.quantserve.com/pixel;r=329650982;labels=_fp.event.Plans;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151678117;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Pricing%20Plans%2Cdescription.Find%20a%20Xero%20pricing%20plan%20to%20suit%20your%20business%252E%20All%20plans%20cover%20the%20accounting%20e%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Fpricing-plans%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=eeeb9e67-23d1-4903-8cb1-0a8f45ce2880;mdl=	false		high
https://xero.demdex.net/event?d_dil_ver=9.4&_ts=1714151611504	false		high
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2F&page_title=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US	false	Avira URL Cloud: safe	unknown
https://static.hotjar.com/c/hotjar-3197823.js?sv=6	false		high
https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY	false		high
https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688252&i=gtm&dwt=5&ive=blur	false		high
https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	false		high
https://aax-eu.amazon-adsystem.com/s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413	false		high
https://xero.demdex.net/event?d_dil_ver=9.4&_ts=1714151624777	false		high
https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=3HVxihCj9z-NsbV_A3f5cyzzgj6IDVEBNMoNRrZQ35otNN7DpW1ofw==&api-version=v2	false		high
https://bam.nr-data.net/jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26996&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/	false	Avira URL Cloud: safe	unknown
https://9401320.fls.doubleclick.net/activityi;dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	false		high
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629405&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&rqm=FGET	false		high
https://uipglob.semasio.net/tradedesk/1/get?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&sInitiator=external&_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dsemasio%26gdpr%3D0%26gdpr_consent%3D	false		high
https://bam.nr-data.net/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=8717&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/&af=err,xhr,stn,ins,spa&be=27&fe=8646&dc=328&perf=%7B%22timing%22:%7B%22of%22:1714151674009,%22n%22:0,%22f%22:3,%22dn%22:3,%22dne%22:3,%22c%22:3,%22s%22:3,%22ce%22:3,%22rq%22:13,%22rp%22:27,%22rpe%22:47,%22di%22:313,%22ds%22:355,%22de%22:355,%22dc%22:8659,%22l%22:8662,%22le%22:8673%7D,%22navigation%22:%7B%7D%7D&fp=251&fcp=251	false	Avira URL Cloud: safe	unknown
https://bam.nr-data.net/events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=15370&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/	false	Avira URL Cloud: safe	unknown
https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151629451&i=gtm&dwt=309&ive=blur	false		high
https://ws.hotjar.com/api/v2/client/ws?v=7&site_id=3197823	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://central.xero.com/s/topic/0TO1N0000017kmRWAQ/giving-people-access-to-xero#business	chromecache_780.9.dr, chromecache_656.9.dr	false		high
https://www.xero.com/au/signup/	chromecache_827.9.dr	false		high
https://www.xero.com/signup/	chromecache_827.9.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_807.9.dr	false		high
https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/stan	chromecache_706.9.dr, chromecache_585.9.dr	false		high
https://www.xero.com/ph/legal/privacy/	chromecache_706.9.dr, chromecache_585.9.dr	false		high
https://www.xero.com/id/signup/	chromecache_827.9.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_653.9.dr, chromecache_829.9.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.	chromecache_653.9.dr, chromecache_829.9.dr	false	Avira URL Cloud: safe	low
https://www.redditstatic.com/ads/581d359d/pixel.js	chromecache_387.9.dr, chromecache_533.9.dr	false		high
https://central.xero.com/s/article/Xero-subscriptions-and-billing	chromecache_507.9.dr, chromecache_662.9.dr	false		high
http://www.amazon.com/b/?&node=7253015011.	chromecache_458.9.dr	false		high
https://www.xero.com/my/pricing-plans/	chromecache_551.9.dr	false		high
https://support.google.com/recaptcha	chromecache_829.9.dr	false		high
https://central.xero.com/s/article/Convert-to-Xero	chromecache_507.9.dr, chromecache_662.9.dr	false		high
https://www.xe.com/legal/	chromecache_780.9.dr, chromecache_656.9.dr	false		high
https://www.xero.com/about/security/	chromecache_780.9.dr, chromecache_656.9.dr	false		high
https://www.xero.com/au/legal/privacy/	chromecache_706.9.dr, chromecache_585.9.dr	false		high
https://www.xero.com/sg/legal/privacy/	chromecache_706.9.dr, chromecache_585.9.dr	false		high
https://www.xero.com/hk/legal/terms/	chromecache_780.9.dr, chromecache_656.9.dr	false		high
https://www.xero.com/ph/	chromecache_581.9.dr, chromecache_852.9.dr, chromecache_598.9.dr	false		high
https://www.xero.com/id/try-now/manage-invoices/	chromecache_870.9.dr	false		high
https://www.awin1.com/sread.img?tt=ns&tv=2&	chromecache_806.9.dr	false		high
https://www.xero.com/about/legal/partner-agreement/	chromecache_780.9.dr, chromecache_656.9.dr	false		high
https://www.xero.com/uk/legal/privacy/	chromecache_706.9.dr, chromecache_585.9.dr	false		high
https://www.xero.com/about/legal/privacy/	chromecache_656.9.dr	false		high
https://central.xero.com/s/article/Privacy-at-Xero	chromecache_585.9.dr	false		high
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1023673485/?random	chromecache_752.9.dr, chromecache_711.9.dr, chromecache_759.9.dr, chromecache_564.9.dr, chromecache_403.9.dr, chromecache_580.9.dr, chromecache_858.9.dr	false		high
https://ads.nextdoor.com/public/pixel/ndp.js	chromecache_806.9.dr	false		high
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=e09cd2aa-71	chromecache_667.9.dr	false		high
https://dpm.demdex.net/ibs:dpid=903&dpuuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=	chromecache_448.9.dr	false		high
https://edge.xero.com/style/xui/22.0.0/xui.min.css	chromecache_424.9.dr	false		high
https://mid.rkdms.com/bct?pid=02760a75-50e3-4c64-b77b-fb5fcd04e437&_ct=img&puid=e09cd2aa-7185-40a5-b	chromecache_419.9.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.32.87.128	unknown	United States	16509	AMAZON-02US	false
52.40.174.159	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
35.244.154.8	id.rlcdn.com	United States	15169	GOOGLEUS	false
13.226.52.4	js.intercomcdn.com	United States	16509	AMAZON-02US	false
35.174.127.31	nexus-websocket-a.intercom.io	United States	14618	AMAZON-AESUS	false
157.240.14.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
142.250.64.162	unknown	United States	15169	GOOGLEUS	false
34.237.73.95	unknown	United States	14618	AMAZON-AESUS	false
13.249.98.79	unknown	United States	16509	AMAZON-02US	false
192.184.68.149	unknown	United States	27281	QUANTCASTUS	false
151.101.193.140	dualstack.reddit.map.fastly.net	United States	54113	FASTLYUS	false
151.101.65.140	unknown	United States	54113	FASTLYUS	false
44.198.199.61	unknown	United States	14618	AMAZON-AESUS	false
68.67.179.153	unknown	United States	29990	ASN-APPNEXUS	false
18.204.189.243	unknown	United States	14618	AMAZON-AESUS	false
13.35.116.64	segments.company-target.com	United States	16509	AMAZON-02US	false
13.32.87.74	unknown	United States	16509	AMAZON-02US	false
18.239.228.142	d1ykf07e75w7ss.cloudfront.net	United States	16509	AMAZON-02US	false
108.157.173.85	static-cdn.hotjar.com	United States	16509	AMAZON-02US	false
44.193.186.241	unknown	United States	14618	AMAZON-AESUS	false
192.178.50.68	unknown	United States	15169	GOOGLEUS	false
192.178.50.66	unknown	United States	15169	GOOGLEUS	false
142.250.189.134	unknown	United States	15169	GOOGLEUS	false
142.250.189.132	unknown	United States	15169	GOOGLEUS	false
18.64.168.121	dg2iu7dxxehbo.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.250.217.228	www.google.com	United States	15169	GOOGLEUS	false
68.67.160.76	unknown	United States	29990	ASN-APPNEXUS	false
68.67.160.75	unknown	United States	29990	ASN-APPNEXUS	false
54.165.219.129	api-iam.intercom.io	United States	14618	AMAZON-AESUS	false
54.84.194.59	unknown	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.249.98.101	tag.demandbase.com	United States	16509	AMAZON-02US	false
52.95.115.196	aax-eu.amazon-adsystem.com	United States	16509	AMAZON-02US	false
172.217.15.194	unknown	United States	15169	GOOGLEUS	false
13.32.87.102	widget.intercom.io	United States	16509	AMAZON-02US	false
192.178.50.38	unknown	United States	15169	GOOGLEUS	false
52.94.222.140	unknown	United States	16509	AMAZON-02US	false
74.125.134.154	unknown	United States	15169	GOOGLEUS	false
173.194.213.154	unknown	United States	15169	GOOGLEUS	false
63.140.39.93	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
54.229.161.54	pacman-metrics-live.live.eks.hotjar.com	United States	16509	AMAZON-02US	false
34.98.67.3	ut.linksynergy.com	United States	15169	GOOGLEUS	false
63.140.39.15	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
99.80.149.126	unknown	United States	16509	AMAZON-02US	false
18.64.174.54	d2fashanjl7d9f.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.250.64.226	adservice.google.com	United States	15169	GOOGLEUS	false
104.244.42.197	unknown	United States	13414	TWITTERUS	false
52.200.166.19	q.quora.com	United States	14618	AMAZON-AESUS	false
34.196.171.164	unknown	United States	14618	AMAZON-AESUS	false
151.101.1.140	reddit.map.fastly.net	United States	54113	FASTLYUS	false
104.244.42.195	s.twitter.com	United States	13414	TWITTERUS	false
3.234.43.148	mid.rkdms.com	United States	14618	AMAZON-AESUS	false
52.223.22.214	us-east-eb2.3lift.com	United States	8987	AMAZONEXPANSIONGB	false
34.239.87.50	unknown	United States	14618	AMAZON-AESUS	false
142.250.64.230	unknown	United States	15169	GOOGLEUS	false
52.45.52.13	unknown	United States	14618	AMAZON-AESUS	false
142.250.64.196	unknown	United States	15169	GOOGLEUS	false
63.140.39.82	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
192.184.68.134	global.px.quantserve.com	United States	27281	QUANTCASTUS	false
3.215.223.76	unknown	United States	14618	AMAZON-AESUS	false
13.35.116.50	unknown	United States	16509	AMAZON-02US	false
151.101.129.140	unknown	United States	54113	FASTLYUS	false
54.156.87.255	unknown	United States	14618	AMAZON-AESUS	false
104.17.127.254	dmp.truoptik.com	United States	13335	CLOUDFLARENETUS	false
68.67.160.26	unknown	United States	29990	ASN-APPNEXUS	false
18.66.255.103	d8ghbpr3r4dzt.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
74.125.26.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.217.166	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.217.164	unknown	United States	15169	GOOGLEUS	false
13.249.98.6	widget.trustpilot.com	United States	16509	AMAZON-02US	false
68.180.135.251	unknown	United States	14780	INKTOMI-LAWSONUS	false
108.157.173.58	d20qwf0wrdtevy.cloudfront.net	United States	16509	AMAZON-02US	false
68.180.135.252	edge.gycpi.b.yahoodns.net	United States	14780	INKTOMI-LAWSONUS	false
142.250.217.162	unknown	United States	15169	GOOGLEUS	false
18.210.82.4	tags.srv.stackadapt.com	United States	14618	AMAZON-AESUS	false
18.173.166.39	ara.paa-reporting-advertising.amazon	United States	3	MIT-GATEWAYSUS	false
34.117.77.79	ml314.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
54.234.5.56	track2.securedvisit.com	United States	14618	AMAZON-AESUS	false
52.209.193.176	unknown	United States	16509	AMAZON-02US	false
34.96.71.22	s.dsp-prod.demandbase.com	United States	15169	GOOGLEUS	false
67.220.224.144	unknown	United States	18450	WEBNXUS	false
18.64.174.79	d2pbcviywxotf2.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.244.42.133	unknown	United States	13414	TWITTERUS	false
76.13.32.146	spdc-global.pbp.gysm.yahoodns.net	United States	26101	YAHOO-3US	false
104.18.36.155	dsum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
192.184.68.234	unknown	United States	27281	QUANTCASTUS	false
63.140.39.22	adobetarget.data.adobedc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
52.50.39.109	wsky-live.live.eks.hotjar.com	United States	16509	AMAZON-02US	false
18.215.83.155	partners-alb-1113315349.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
173.194.216.155	unknown	United States	15169	GOOGLEUS	false
52.223.40.198	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
18.210.31.191	unknown	United States	14618	AMAZON-AESUS	false
13.32.87.20	tag-logger.demandbase.com	United States	16509	AMAZON-02US	false
146.75.124.157	platform.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
157.240.14.19	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
13.226.52.120	unknown	United States	16509	AMAZON-02US	false
172.64.151.101	unknown	United States	13335	CLOUDFLARENETUS	false
13.226.52.60	script.hotjar.com	United States	16509	AMAZON-02US	false
104.94.108.142	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432277
Start date and time:	2024-04-26 19:11:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Activity Statement for User 01Apr2024-30Apr2024.pdf
Detection:	MAL
Classification:	mal48.phis.winPDF@71/856@446/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://www.xero.com/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals Browse: https://www.xero.com/us/pricing-plans/ Browse: https://www.xero.com/us/ Close Viewer Browse: https://www.xero.com/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals Browse: https://www.xero.com/us/pricing-plans/ Browse: https://www.xero.com/us/ Browse: https://www.xero.com/us/signup/

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.204.76.141, 52.5.13.197, 52.202.204.11, 54.227.187.23, 23.22.254.206, 172.64.41.3, 162.159.61.3, 23.221.212.219, 23.221.212.204, 199.232.214.172, 192.229.211.108, 142.250.64.195, 184.84.136.204, 142.250.217.206, 142.251.162.84, 34.104.35.123, 23.67.65.242, 142.250.217.170, 142.250.64.138, 142.250.217.234, 172.217.165.202, 142.250.217.202, 172.217.3.74, 172.217.2.202, 142.251.35.234, 142.250.189.138, 192.178.50.74, 192.178.50.42, 172.217.15.202, 104.109.133.143, 23.34.204.146, 23.193.120.139, 23.197.26.244, 142.250.217.232, 142.250.64.234, 18.214.187.99, 3.231.172.141, 107.23.170.82, 54.81.79.202, 3.89.230.254, 107.20.184.57, 192.178.50.46, 23.55.103.97, 23.55.103.51, 204.79.197.237, 13.107.21.237, 13.107.42.14, 142.250.189.142, 23.204.76.188, 162.159.152.17, 162.159.153.247, 192.178.50.34, 8.43.72.97, 8.43.72.98, 104.109.132.246, 23.219.2.146, 23.219.2.156, 172.217.165.195, 172.217.165.206, 23.43.236.32, 104.18.36.18, 172.64.151.238, 142.250.64.170, 192.178.50.35,
Excluded domains from analysis (whitelisted): tags.bluekai.com.edgekey.net, e6513.a.akamaiedge.net, uipglob.trafficmanager.net, slscr.update.microsoft.com, user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net, clientservices.googleapis.com, e11670.a.akamaiedge.net, acroipm2.adobe.com, l-0005.l-msedge.net, e9126.x.akamaiedge.net, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, www.xero.com.edgekey.net, www.gstatic.com, secure-adnxs.edgekey.net, e124741.a.akamaiedge.net, www.google-analytics.com, ip46.go-mpulse.net.edgekey.net, fs.microsoft.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, cm.everesttech.net.akadns.net, e4016.a.akamaiedge.net, new-edge.xero.com.edgekey.net, od.linkedin.edgesuite.net, e8173.a.akamaiedge.net, edgedl.me.gvt1.com, wildcard46.go-mpulse.net.edgekey.net, map.media6degrees.com.cdn.cloudflare.net, clients.l.google.com, geo2.adobe.com, a1916.dscg2.akamai.net, e4578.dscg.akamaiedge.net,
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.32.87.128	https://myatt-business-104731-100520.square.site/	Get hash	malicious	Unknown	Browse
13.32.87.128	https://mershonwhlte-penergy-urtee.atlassian.net/wiki/external/OTcwMzA4NDViY2YzNGZhODkxMGVkZDdmYTc1NGE5ODE	Get hash	malicious	Unknown	Browse
34.237.73.95	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse
	https://app.milanote.com/1RZbnl1zfBXuaf?p=r2B66sphbV4	Get hash	malicious	Unknown	Browse
	https://gamma.app/docs/Shared-Document-9j9g6z8iqo1w0uu	Get hash	malicious	HTMLPhisher	Browse
	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse
	https://in.xero.com/m/g4EjeZDud5lCeLiKvMaATTgixUJedYwIXI96osSo?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse
	https://runrun.it/share/portal/EfC1XUoTbGbNOUmd	Get hash	malicious	HTMLPhisher	Browse
	https://johns-organization-77.gitbook.io/shareddoc	Get hash	malicious	HTMLPhisher	Browse
	https://www.ultimatejetvacations.com/	Get hash	malicious	Unknown	Browse
192.184.68.149	https://truj.pages.dev/robots.txt	Get hash	malicious	HTMLPhisher	Browse
	Enrollment PO, from United Way of the Midlands.eml	Get hash	malicious	Unknown	Browse
	https://att-yahoo-mail-109335-106163.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://pksgsda.weeblysite.com/	Get hash	malicious	Unknown	Browse
	http://www.die-senioren.de	Get hash	malicious	Unknown	Browse
	https://dkdeep.com/	Get hash	malicious	Unknown	Browse
	https://servnert.square.site/	Get hash	malicious	Unknown	Browse
	https://attttttttttoooo.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://nh3f.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://attttttttttt-101329.weeblysite.com/	Get hash	malicious	Unknown	Browse
52.40.174.159	https://yxu.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2Fpassword	Get hash	malicious	HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:2fbb59a5-45e3-4bc2-91f7-1018be0086b6	Get hash	malicious	Unknown	Browse
	https://www.googleadservices.com/pagead/aclk?nis=4&sa=L&ai=CEdmnpF3uZcmCEdLvz7sPgvaqSPDagOV127nPn6ISzuvWiowOEAEg-5yHA2CloJWAmAGgAfeloJQqyAECqAMByAPJBKoEqwJP0BOkHEQ1sHidZNLLodOtOyNxRFvrb6dqQQ9bhh3nOz-pugkuAKGT1JYZfWYhqel0zPTGGIbQQl9WB7_vFRV_MhmW5KIdroYx56OEClXEf-cWKat1aMrWuR35plIHQwgvrSp12MLefXdgr14Q5iELw4ozv24CWRBqCYEfchlQo4JnIovylCFfzNZg20N_V5T9lzIG1Nmm7l9MsFsKkwM-YPqei9OqUr9BDzie_LrcWi_Z2StMoNSQV8r8i1V33taCy4_lrZuMV-NzUQMD4TyIxtNRQLwkroqGCsQ7cBlARGQKqa5EXlyqKFmykXE2LLDQkRi_RahzgB5fX3_TIZgU_j7XfKOQqjgPSHLXdiWLqHfAPFpqdb7SXyjvdXpJEi0l2R3bDl1grQiXI8AE1LSHmu8EiAWfhcyjTqAGAoAH993w8wSoB9m2sQKoB6--sQKoB9XJG6gHpr4bqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7ECqAfKqbECqAfrpbECqAfqsbECqAeZtbECqAe-t7EC2AcB0ggkCIBhEAEYHzICigI6CYBAgMCAgICgKEi9_cE6WPfE7-KG64QDsQloFY0I819HuIAKAZgLAcgLAdoMEAoKELC17cf6_vjlBxICAQOqDQJBVcgNAdgTAtAVAfgWAYAXAbIYCRICgmgYAiIBAA&ae=1&ase=2&gclid=EAIaIQobChMIyeTv4obrhAMV0vdzAR0CuwoJEAEYASAAEgL6PvD_BwE&num=1&cid=CAQSOwB7FLtqsHK094spdoaQt-h9iX5PJ9zt-19kvYM1ldowDR1zOpgYOBfr1d5CeT8AheT9Tiy6z0yLnfuSGAE&sig=AOD64_2YAv3hZTWz95W_YbVDPxMhn7xpXg&client=ca-pub-3734677162347682&rf=2&nb=17&adurl=https://sites.google.com/view/fashionpassrent%3Fgclid%3DEAIaIQobChMIyeTv4obrhAMV0vdzAR0CuwoJEAEYASAAEgL6PvD_BwE	Get hash	malicious	Unknown	Browse
13.226.52.4	https://flow.page/sync1systems.com&d=DwMGaQ	Get hash	malicious	Unknown	Browse
	https://kergering.wordpress.com/special-giveaway/	Get hash	malicious	Unknown	Browse
	https://streamstv.org/soccer	Get hash	malicious	Unknown	Browse
35.174.127.31	https://runrun.it/share/form/0GZMCgHSxRh4PBOM	Get hash	malicious	HTMLPhisher	Browse
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse
	https://runrun.it/share/form/0SRuaDvcQOCgwT9F	Get hash	malicious	HTMLPhisher	Browse
	http://gamma.app/docs/Adobe-1098-uanmwmhgl6i90tc?mode=doc	Get hash	malicious	Unknown	Browse
	https://johns-organization-77.gitbook.io/shareddoc	Get hash	malicious	HTMLPhisher	Browse
	https://gamma.app/docs/Shared-Document-t1avmvp1d4i6t2p	Get hash	malicious	HTMLPhisher	Browse
	https://windows360help.com/?domain=amateurok.com	Get hash	malicious	Unknown	Browse
	https://flow.page/sync1systems.com&d=DwMGaQ	Get hash	malicious	Unknown	Browse
	https://gamma.app/setup?code=4uu2lb5tf1x5irk&flow=signup&email=t.okeeffe2%40universityofgalway.ie	Get hash	malicious	Unknown	Browse
	https://app.getbeamer.com/7132428100/en	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
segments.company-target.com	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	216.137.39.63
	_file____C__Users_hp_Downloads_C__Users_moodyt_AppData_Local_Temp_2_RemittanceAdvice17-Apr-2024.html	Get hash	malicious	Unknown	Browse	99.84.191.65
	https://in.xero.com/m/g4EjeZDud5lCeLiKvMaATTgixUJedYwIXI96osSo?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	13.225.63.60
	https://app.esign.docusign.com/e/er?utm_campaign=GBL_XX_DBU_NEW_2307_FreetoTrialUnlock_Email1AU&utm_medium=email&utm_source=Eloqua&elqCampaignId=29542&s=566810826&lid=32871&elqTrackId=1034fb987fd44c9a9a4d0833ff06a55d&elq=89d72859fe264966a0176d4309dbb1a6&elqaid=60251&elqat=1	Get hash	malicious	Unknown	Browse	3.161.193.38
	http://cf-ipfs.com	Get hash	malicious	Unknown	Browse	3.161.193.119
	https://att-mail-ins.weeblysite.com/	Get hash	malicious	Unknown	Browse	13.225.63.113
	http://cf-ipfs.com	Get hash	malicious	Unknown	Browse	18.173.219.69
	https://streaklinks.com/B668awohoT-6Ye2tFgRXf5YV/https%3A%2F%2Fna4.docusign.net%2FMember%2FPowerFormSigning.aspx%3FPowerFormId%3D02d7044c-ca42-47bd-b048-f7d24113182f%26env%3Dna4%26acct%3D385d7234-0a2d-491f-a570-28297578e366%26v%3D2	Get hash	malicious	Unknown	Browse	18.64.174.27
	http://56hytuti5.weebly.com	Get hash	malicious	Unknown	Browse	13.35.116.107
	https://myatt-business-104731-100520.square.site/	Get hash	malicious	Unknown	Browse	13.35.116.107
global.px.quantserve.com	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	192.184.67.143
	http://confirmartucuentamsnaquimx.hstn.me/login.live.com_login_verify_credentials_outlook.html	Get hash	malicious	HTMLPhisher	Browse	192.184.67.70
	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	192.184.67.70
	https://i.imgur.com/EoTj4iI.png	Get hash	malicious	Unknown	Browse	192.184.67.84
	https://i.imgur.com/VlAllek.png	Get hash	malicious	Unknown	Browse	192.184.67.84
	Remittance. #U0440df.html	Get hash	malicious	HTMLPhisher	Browse	192.184.68.228
	https://22apmic22.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	192.184.67.18
	https://in.xero.com/m/g4EjeZDud5lCeLiKvMaATTgixUJedYwIXI96osSo?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	192.184.67.18
	https://19apmic17.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	192.184.67.143
	https://19apmic11.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	192.184.67.18
pacman-content-live.live.eks.hotjar.com	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	99.80.149.126
	https://jobrad.us1.list-manage.com/track/click?u=9c40c69097d5cc62620fab666&id=4174455835&e=1c8272e83c	Get hash	malicious	Unknown	Browse	52.17.168.72
	https://trk.klclick.com/ls/click?upn=u001.Q-2FRM-2Bs26jJfGw5AtNrGvPEpiYllAILKTCuEz5KyWVHWD9QoZxAEjbNi-2Bi-2FCwAkIlMG-2Bc8kPNUyC4MppkD0fmXflfdQrCTILVDR8gFHTHV68-3DmiN2_92JIOwjy-2FBOFWYVmWPQALvZwY1kX1u9N0JFdTgs9mtTpVa6hKwHYQXVimw-2Fwm0NxaEflv7WP8GigLGQPDCt6Pq27jFgn20lHwxIznKdLuBK6ehvwNFZSWN7sbifJLsRGHhHCOyx9Nq4fdhl03U7ZdVEwSApdtY2AZ9tsgpL2hKe2aC9dnOLYoGVJOupb4BY82AtZznnEyS2NQALpYiQU7lcQKbFkBG6m79b-2Blg8TQAZyprJh2vihaq-2BSiJq6dK8jfprIsdwxOhvGsRJakAK8DRx1Ssq1qPzpPwerWKRxJ94jxP9xwZhmNbJkOfd0iWgP	Get hash	malicious	Unknown	Browse	54.154.35.245
	US Vendor Self Certification 2024.docx	Get hash	malicious	Unknown	Browse	54.154.122.28
	http://acsense.com	Get hash	malicious	Unknown	Browse	52.51.163.76
	https://arvest-securev2.com/	Get hash	malicious	HTMLPhisher	Browse	52.48.131.242
	https://ln.run/eJbja	Get hash	malicious	Phisher	Browse	63.34.228.124
	https://cthompson-vsc16.coupacloud.com/quotes/external_responses/b30e6941a7e0553e0d3b5d318c8a406aefe85fa0bd4d5e844560a248434cc9ccd28fbee0140d9980/terms?response_intend=true	Get hash	malicious	Unknown	Browse	18.202.121.248
	http://shortens.me	Get hash	malicious	Unknown	Browse	54.77.223.45
	https://www.eventcreate.com/e/rfp-reference-recommendatio	Get hash	malicious	Unknown	Browse	18.202.200.130
d2fashanjl7d9f.cloudfront.net	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	18.164.174.99
	https://in.xero.com/m/g4EjeZDud5lCeLiKvMaATTgixUJedYwIXI96osSo?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	3.161.136.75
	https://jf3su0nc82kocw61.blob.core.windows.net/jf3su0nc82kocw61/1.html?4WNYDE6475pnqu82jukhgadbqc940IQTGHHCQEULWJIX13036XJPP12205G13#13/82-6475/940-13036-12205	Get hash	malicious	HTMLPhisher	Browse	13.226.34.90
	https://att-mail-ins.weeblysite.com/	Get hash	malicious	Unknown	Browse	13.226.34.90
	http://56hytuti5.weebly.com	Get hash	malicious	Unknown	Browse	18.64.174.13
	https://myatt-business-104731-100520.square.site/	Get hash	malicious	Unknown	Browse	13.35.116.100
	http://evvitteponn.info/	Get hash	malicious	HTMLPhisher	Browse	13.35.116.100
	https://my-business-108994-102321.square.site/	Get hash	malicious	Unknown	Browse	52.85.151.82
	https://att-login309.weeblysite.com/	Get hash	malicious	Unknown	Browse	52.85.151.59
	https://urlz.fr/pPLC	Get hash	malicious	Unknown	Browse	13.226.34.70

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	xsyGizeAYW.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	RsrhTw5KFy.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	54.148.51.66
	0ll10IxBC6.elf	Get hash	malicious	Gafgyt	Browse	34.243.160.129
	vz8qgkjO5C.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	B7eC0wN0cJ.elf	Get hash	malicious	Gafgyt	Browse	34.243.160.129
	323nndksdhndsf783.docx	Get hash	malicious	Unknown	Browse	18.134.24.143
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	108.157.172.96
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	18.217.61.96
	http://url9212.charteredarena.org/ls/click?upn=u001.kjyKVeM-2Fb1rGOGHOnr1jOBOY3L3JqbNTsl6-2FG2Q28FBbMvScULOdn5hj4fYmOT1gSvNV_eFFQU5nW4TX33oYM-2FvMZ4H4nrQnEbWOt7nYb46lhhradIe8kQ30nH41Yux5-2ByqjXVzNOeRGeH70TSwGBG-2FsCyfS-2BqFuy7r7yA-2BMVhshonhVyPepAGojJAWOStPfHQEXVhS9QapMz6-2FLiLkIDitr77rwl6cV3-2BOVbi0qMHcpubANPDna-2BAJRWKHhsn2J-2BHsm2h-2B1n0PvhIvECyeSGKW-2FdmoYnwMnfXv-2F0VHDQdAF4JyTklFAWOdWvqmq9QaL29M0Lqvm9PdkAaDucmiv1yWhzGJ-2FSlIlic4yMaUzKSM2tXbVKRT-2BcTJHrLGjV82z-2BxMi-2FPWDvS9vQSeDz0xjN0gvzYnMQqfZiJ7fdvgXYvIvcGvziknMmHkQ7sUHmtLIGr6gsv-2FI2qInnZxnaJ1Ow7w3sMmgc-2FLcAEaJe5QnWJ5qez1H3mc7J1f4VLI4PyjCxv7syUPC13rDkwMklRiABfKztYQ3n9LW3FeH4hgMGYJgJovBs-2FKlVUipIzO24iLrfZpg-2FS6-2Fvp-2BRnBXh4Gim5LY7NxdelnIZomgKJ8r1gxfM163jd5ekCcUFZcZJn8BUr-2FrBOq6vvyf5Ut44ln9oAHSsmy2ecvwUHxQ-2Bo0mJA2r9a8FeSV3APNVBZowUa1ZGpOSvbZRLc6uZxrFl3fSWY774fhm-2Fl3qG7s-2BRWj2lGIHB3NEqH1X520Diu5Le7soeKgWoeaLCSrT5v7lt-2B7XayjukGYP4Yz5jSqZD2gXDxl443sgS6brqBQ3LKHfRN7s2NZ-2F6nWblHw6-2BLG-2FTduGCq0lMfhnVz7mFWLyKhJHvoE3C2dN6qv1-2FpHnRcIGopoYVEdZ-2F182c7Ll7OsxlzgTKemGKriHFjxwOhwkIoHVdgcJWnLS8-3D	Get hash	malicious	Unknown	Browse	13.249.98.111
AMAZON-02US	xsyGizeAYW.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	RsrhTw5KFy.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	54.148.51.66
	0ll10IxBC6.elf	Get hash	malicious	Gafgyt	Browse	34.243.160.129
	vz8qgkjO5C.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	B7eC0wN0cJ.elf	Get hash	malicious	Gafgyt	Browse	34.243.160.129
	323nndksdhndsf783.docx	Get hash	malicious	Unknown	Browse	18.134.24.143
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	108.157.172.96
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	18.217.61.96
	http://url9212.charteredarena.org/ls/click?upn=u001.kjyKVeM-2Fb1rGOGHOnr1jOBOY3L3JqbNTsl6-2FG2Q28FBbMvScULOdn5hj4fYmOT1gSvNV_eFFQU5nW4TX33oYM-2FvMZ4H4nrQnEbWOt7nYb46lhhradIe8kQ30nH41Yux5-2ByqjXVzNOeRGeH70TSwGBG-2FsCyfS-2BqFuy7r7yA-2BMVhshonhVyPepAGojJAWOStPfHQEXVhS9QapMz6-2FLiLkIDitr77rwl6cV3-2BOVbi0qMHcpubANPDna-2BAJRWKHhsn2J-2BHsm2h-2B1n0PvhIvECyeSGKW-2FdmoYnwMnfXv-2F0VHDQdAF4JyTklFAWOdWvqmq9QaL29M0Lqvm9PdkAaDucmiv1yWhzGJ-2FSlIlic4yMaUzKSM2tXbVKRT-2BcTJHrLGjV82z-2BxMi-2FPWDvS9vQSeDz0xjN0gvzYnMQqfZiJ7fdvgXYvIvcGvziknMmHkQ7sUHmtLIGr6gsv-2FI2qInnZxnaJ1Ow7w3sMmgc-2FLcAEaJe5QnWJ5qez1H3mc7J1f4VLI4PyjCxv7syUPC13rDkwMklRiABfKztYQ3n9LW3FeH4hgMGYJgJovBs-2FKlVUipIzO24iLrfZpg-2FS6-2Fvp-2BRnBXh4Gim5LY7NxdelnIZomgKJ8r1gxfM163jd5ekCcUFZcZJn8BUr-2FrBOq6vvyf5Ut44ln9oAHSsmy2ecvwUHxQ-2Bo0mJA2r9a8FeSV3APNVBZowUa1ZGpOSvbZRLc6uZxrFl3fSWY774fhm-2Fl3qG7s-2BRWj2lGIHB3NEqH1X520Diu5Le7soeKgWoeaLCSrT5v7lt-2B7XayjukGYP4Yz5jSqZD2gXDxl443sgS6brqBQ3LKHfRN7s2NZ-2F6nWblHw6-2BLG-2FTduGCq0lMfhnVz7mFWLyKhJHvoE3C2dN6qv1-2FpHnRcIGopoYVEdZ-2F182c7Ll7OsxlzgTKemGKriHFjxwOhwkIoHVdgcJWnLS8-3D	Get hash	malicious	Unknown	Browse	13.249.98.111
AMAZON-02US	xsyGizeAYW.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	RsrhTw5KFy.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	54.148.51.66
	0ll10IxBC6.elf	Get hash	malicious	Gafgyt	Browse	34.243.160.129
	vz8qgkjO5C.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	B7eC0wN0cJ.elf	Get hash	malicious	Gafgyt	Browse	34.243.160.129
	323nndksdhndsf783.docx	Get hash	malicious	Unknown	Browse	18.134.24.143
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	108.157.172.96
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	18.217.61.96
	http://url9212.charteredarena.org/ls/click?upn=u001.kjyKVeM-2Fb1rGOGHOnr1jOBOY3L3JqbNTsl6-2FG2Q28FBbMvScULOdn5hj4fYmOT1gSvNV_eFFQU5nW4TX33oYM-2FvMZ4H4nrQnEbWOt7nYb46lhhradIe8kQ30nH41Yux5-2ByqjXVzNOeRGeH70TSwGBG-2FsCyfS-2BqFuy7r7yA-2BMVhshonhVyPepAGojJAWOStPfHQEXVhS9QapMz6-2FLiLkIDitr77rwl6cV3-2BOVbi0qMHcpubANPDna-2BAJRWKHhsn2J-2BHsm2h-2B1n0PvhIvECyeSGKW-2FdmoYnwMnfXv-2F0VHDQdAF4JyTklFAWOdWvqmq9QaL29M0Lqvm9PdkAaDucmiv1yWhzGJ-2FSlIlic4yMaUzKSM2tXbVKRT-2BcTJHrLGjV82z-2BxMi-2FPWDvS9vQSeDz0xjN0gvzYnMQqfZiJ7fdvgXYvIvcGvziknMmHkQ7sUHmtLIGr6gsv-2FI2qInnZxnaJ1Ow7w3sMmgc-2FLcAEaJe5QnWJ5qez1H3mc7J1f4VLI4PyjCxv7syUPC13rDkwMklRiABfKztYQ3n9LW3FeH4hgMGYJgJovBs-2FKlVUipIzO24iLrfZpg-2FS6-2Fvp-2BRnBXh4Gim5LY7NxdelnIZomgKJ8r1gxfM163jd5ekCcUFZcZJn8BUr-2FrBOq6vvyf5Ut44ln9oAHSsmy2ecvwUHxQ-2Bo0mJA2r9a8FeSV3APNVBZowUa1ZGpOSvbZRLc6uZxrFl3fSWY774fhm-2Fl3qG7s-2BRWj2lGIHB3NEqH1X520Diu5Le7soeKgWoeaLCSrT5v7lt-2B7XayjukGYP4Yz5jSqZD2gXDxl443sgS6brqBQ3LKHfRN7s2NZ-2F6nWblHw6-2BLG-2FTduGCq0lMfhnVz7mFWLyKhJHvoE3C2dN6qv1-2FpHnRcIGopoYVEdZ-2F182c7Ll7OsxlzgTKemGKriHFjxwOhwkIoHVdgcJWnLS8-3D	Get hash	malicious	Unknown	Browse	13.249.98.111
AMAZON-AESUS	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	52.6.239.236
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	52.205.88.207
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse	3.94.175.225
	https://runrun.it/share/form/0GZMCgHSxRh4PBOM	Get hash	malicious	HTMLPhisher	Browse	44.217.183.210
	http://ww1.lourdoueisienne.website/	Get hash	malicious	Unknown	Browse	3.93.251.206
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:d35aec95-f365-414c-8371-68e6d7d2ec41	Get hash	malicious	Unknown	Browse	3.215.128.155
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	52.55.103.136
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	54.204.238.15
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	44.214.72.116
	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	52.204.88.175
AMAZON-AESUS	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	52.6.239.236
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	52.205.88.207
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse	3.94.175.225
	https://runrun.it/share/form/0GZMCgHSxRh4PBOM	Get hash	malicious	HTMLPhisher	Browse	44.217.183.210
	http://ww1.lourdoueisienne.website/	Get hash	malicious	Unknown	Browse	3.93.251.206
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:d35aec95-f365-414c-8371-68e6d7d2ec41	Get hash	malicious	Unknown	Browse	3.215.128.155
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	52.55.103.136
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	54.204.238.15
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	44.214.72.116
	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	52.204.88.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	23.1.237.91
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	23.1.237.91
	https://runrun.it/share/form/0GZMCgHSxRh4PBOM	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	InmateExport.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://svif-venezuela.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://www.alserhgroup.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	Packing List PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	23.1.237.91
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	13.85.23.86 23.204.76.112
	z55NF-Faturada-23042024.msi	Get hash	malicious	MicroClip	Browse	13.85.23.86 23.204.76.112
	Housecallpro Chase Bank ACH.htm	Get hash	malicious	Unknown	Browse	13.85.23.86 23.204.76.112
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	13.85.23.86 23.204.76.112
	http://relevanteduofficelogin.relevantedu.xyz	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.204.76.112
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.204.76.112
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	13.85.23.86 23.204.76.112
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 23.204.76.112
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse	13.85.23.86 23.204.76.112
	https://srmcorp.tecuidoc.com/?PSZlk=ViP	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.204.76.112

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.206823329121535
Encrypted:	false
SSDEEP:	6:mdqM+q2P92nKuAl9OmbnIFUt8JhmZmw+JhpMVkwO92nKuAl9OmbjLJ:msM+v4HAahFUt8J8/+J3MV5LHAaSJ
MD5:	E0425F92668ECC323F2F4FCCB98CC24F
SHA1:	70538D3CA3748059B16F8E737075264AB9982CE2
SHA-256:	230A2C5DD091503A3BDB5E7221E18AF84224B72FFADAC5C9BC564186B539EF99
SHA-512:	98EB265E22D9D04B45E56A834BDC7D7511B1A4E2A9DDA639283562A051799FA42B87C0B8C794FBB25E165B9A35DEFE946738659EBE9472C7840A73C0CBF8C7C9
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:12:06.361 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-19:12:06.362 198c Recovering log #3.2024/04/26-19:12:06.362 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.206823329121535
Encrypted:	false
SSDEEP:	6:mdqM+q2P92nKuAl9OmbnIFUt8JhmZmw+JhpMVkwO92nKuAl9OmbjLJ:msM+v4HAahFUt8J8/+J3MV5LHAaSJ
MD5:	E0425F92668ECC323F2F4FCCB98CC24F
SHA1:	70538D3CA3748059B16F8E737075264AB9982CE2
SHA-256:	230A2C5DD091503A3BDB5E7221E18AF84224B72FFADAC5C9BC564186B539EF99
SHA-512:	98EB265E22D9D04B45E56A834BDC7D7511B1A4E2A9DDA639283562A051799FA42B87C0B8C794FBB25E165B9A35DEFE946738659EBE9472C7840A73C0CBF8C7C9
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:12:06.361 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-19:12:06.362 198c Recovering log #3.2024/04/26-19:12:06.362 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.17866138488777
Encrypted:	false
SSDEEP:	6:yXWM+q2P92nKuAl9Ombzo2jMGIFUt8pcKo1Zmw+47N1WMVkwO92nKuAl9Ombzo23:yXL+v4HAa8uFUt8p/m/+CjLV5LHAa8RJ
MD5:	B259ACAE018A1D81DAB9EC1AA287D5FE
SHA1:	243ED340689B5416A3F2FA7C90F0A3E56E75DB92
SHA-256:	1E107701E133A5824957BD6FFBC22D58FF207DC45DD4A2EC75DF0A5A3EED945C
SHA-512:	7CE1B6E71E12A49E64443C30900FE7E9E6BA464C1FC69F06F5EBCE05787C085F826B9143B4D883AE3A4D7B89AE56740BAA299BED6BCF64CFD71724AE2C8A2930
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:12:06.508 f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-19:12:06.509 f1c Recovering log #3.2024/04/26-19:12:06.510 f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.17866138488777
Encrypted:	false
SSDEEP:	6:yXWM+q2P92nKuAl9Ombzo2jMGIFUt8pcKo1Zmw+47N1WMVkwO92nKuAl9Ombzo23:yXL+v4HAa8uFUt8p/m/+CjLV5LHAa8RJ
MD5:	B259ACAE018A1D81DAB9EC1AA287D5FE
SHA1:	243ED340689B5416A3F2FA7C90F0A3E56E75DB92
SHA-256:	1E107701E133A5824957BD6FFBC22D58FF207DC45DD4A2EC75DF0A5A3EED945C
SHA-512:	7CE1B6E71E12A49E64443C30900FE7E9E6BA464C1FC69F06F5EBCE05787C085F826B9143B4D883AE3A4D7B89AE56740BAA299BED6BCF64CFD71724AE2C8A2930
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:12:06.508 f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-19:12:06.509 f1c Recovering log #3.2024/04/26-19:12:06.510 f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9261021b-d6b3-4329-ad49-31916ab92cef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0434038189663415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZQVWtsBdOg2HGcaq3QYiubxnP7E4T3OF+:Y2sRdsrVLdMH53QYhbxP7nbI+
MD5:	68B6AC2A7626A81A23639D44C15CD7D6
SHA1:	2F3F42270527D6029D0A44E933252803826E1C80
SHA-256:	762C954A1B4C9BB2232009FE5191209F2553FB10E9662F77A2C7E5542EC6511B
SHA-512:	B9E074B549E6881C964EB37BF271A947AB73994FE2A808801301722AC5EF43CFBAE6CDC9665854476192E233BEA462A870859499C0313C5CE5866902868E52EB
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358711538365165","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127136},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0434038189663415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZQVWtsBdOg2HGcaq3QYiubxnP7E4T3OF+:Y2sRdsrVLdMH53QYhbxP7nbI+
MD5:	68B6AC2A7626A81A23639D44C15CD7D6
SHA1:	2F3F42270527D6029D0A44E933252803826E1C80
SHA-256:	762C954A1B4C9BB2232009FE5191209F2553FB10E9662F77A2C7E5542EC6511B
SHA-512:	B9E074B549E6881C964EB37BF271A947AB73994FE2A808801301722AC5EF43CFBAE6CDC9665854476192E233BEA462A870859499C0313C5CE5866902868E52EB
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358711538365165","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127136},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.240746938383937
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU6TeXk/Z:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLp
MD5:	F61ABB7FEA3C681498D7D257D1A0E817
SHA1:	C854E5398FF171D63DBC216171F7F26001BA9FC8
SHA-256:	3D70D69E61290096B782B168F3E382D801DDFD18156E12E50164D096D2FE79DA
SHA-512:	0B7430D07F44A1263519B09886B1978C508B5C4F578B552E6B2D652A04DDF71BB0757A4519A7DC45BAFA4BA7FEBA4F4FA9D709AC00BFAC2D2098C054ACF0731D
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.184161366718094
Encrypted:	false
SSDEEP:	6:HF31WM+q2P92nKuAl9OmbzNMxIFUt8711Zmw+61WMVkwO92nKuAl9OmbzNMFLJ:llL+v4HAa8jFUt8r/+ELV5LHAa84J
MD5:	8E3022B023665E169596ACE9B5363744
SHA1:	50429492F67C0B7BB67354A6CA3D8C5DB0474994
SHA-256:	E22C69BAA67462FAB7E55D7B01961F9B0F86BCFD48E597550AABE253E0BD87FB
SHA-512:	A18BDD134D171B23739EF764FE04FB60E254D2377B5E9A4A974F2F080EA9DAA629292BCCEF2A0454B4B765C8E0954508223BF5793D0C56149A6DAD704151B6D3
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:12:06.770 f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-19:12:06.771 f1c Recovering log #3.2024/04/26-19:12:06.772 f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.184161366718094
Encrypted:	false
SSDEEP:	6:HF31WM+q2P92nKuAl9OmbzNMxIFUt8711Zmw+61WMVkwO92nKuAl9OmbzNMFLJ:llL+v4HAa8jFUt8r/+ELV5LHAa84J
MD5:	8E3022B023665E169596ACE9B5363744
SHA1:	50429492F67C0B7BB67354A6CA3D8C5DB0474994
SHA-256:	E22C69BAA67462FAB7E55D7B01961F9B0F86BCFD48E597550AABE253E0BD87FB
SHA-512:	A18BDD134D171B23739EF764FE04FB60E254D2377B5E9A4A974F2F080EA9DAA629292BCCEF2A0454B4B765C8E0954508223BF5793D0C56149A6DAD704151B6D3
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:12:06.770 f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-19:12:06.771 f1c Recovering log #3.2024/04/26-19:12:06.772 f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426171211Z-171.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	0.8232152378715694
Encrypted:	false
SSDEEP:	96:PfnqOIewLc4ObHVhxLDfo4nfXIEYLuqp0D7n2bLL8/rshmQm:PfnacNbH9DgMgE/u0D7C8/r0Xm
MD5:	3BEE7B6B8F125C927D8E1DECD62C1497
SHA1:	3B43C528D4C6459E84FBF78E44B54FC0C9C3DF47
SHA-256:	41561C5DADBB8E651D9D13388619B52F8389753F71ACED1EBC4CE607CF96C686
SHA-512:	B3618162FFF5A796E6E7ABF52FB881E6F9CB99FBB763DD37B67BF16280AF78FABD2C72F0E9456931370220D504CB0BB83FFA3F1E255A2ABA80584CC3660AA94A
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5456

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	227002
Entropy (8bit):	3.392780893644728
Encrypted:	false
SSDEEP:	1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
MD5:	87EDBEE38F56C20298F25D5D3D4D1B5C
SHA1:	7F904E9615AC3186A87472EF366DD8202855B0B7
SHA-256:	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
SHA-512:	BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.334120363928199
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJM3g98kUwPeUkwRe9:YvXKXJYpW7bOGMbLUkee9
MD5:	6CED60CAD13C7CEFEDB6C99F401D3240
SHA1:	873C3A718382F44A54829A6EC6C2625F636D7F4A
SHA-256:	2958279A10F92DDA3EDF04F6FB9F73EA4CF2255E3FF0444AD14130AA048F0A55
SHA-512:	C030596280CE1BFC5BCA5A9D5CD5714B5164D43A01130D9A78C7A41EDF865423B8F97BCF4F2C7F069F34C78DD927B433806C26953105A6C73509847DEAF0EF97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273455561594613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfBoTfXpnrPeUkwRe9:YvXKXJYpW7bOGWTfXcUkee9
MD5:	AE91BB8A954DF9F66C3BB652669E9801
SHA1:	07326FCF0E64F39846E7546B7F1A1F763A296146
SHA-256:	F91C8AAE7B742E89AF6AD6D0190E46DEA53FFF05C0DDF67B85180969FD730B05
SHA-512:	6B5E828F25B35C4668BD5104D3767A053884667C4B4465840F4B5AA4BD954D385D6C4B963E98F08B0BFADB5648AEC02655F0B9F1C351EAF1153ACE759968E854
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.252942130732015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXJYpW7bOGR22cUkee9
MD5:	9BD69C9878B13C9C6C8048267818AB8B
SHA1:	608C18C136A7FB96D23F3218988A79FB01515723
SHA-256:	E909D1764DE8169AB5454E5777AD9B19FBE8031F5BC60241B9E3D8076CED3EDC
SHA-512:	778F0F5486912AA1E4EB344598FA87C2F2628E3AD0557D51741E2D6D82787C8C8C4AE8F46203822CDCE25A2E0E71870E2B4AD412E4FDBE82229EF3B87DC22B46
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.311987170621118
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfPmwrPeUkwRe9:YvXKXJYpW7bOGH56Ukee9
MD5:	B286ADD8B30D364C37ED14F3CA48E0F8
SHA1:	87B80A451BC75389C73BCB4AD14B8FA3E82D00D1
SHA-256:	41E58277DEE83D938ED1AA3828D9B47AF719221809258430A42E5AB11C3421F5
SHA-512:	D2B6EB56740501DB4551CC7A34737D885828EA7D3163F94902B9FFE504779108DDDE1FEC61C3CA8255F6B369EDF86BDFE2250208446B2955E850DE9CDF978C25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.271240648534457
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfJWCtMdPeUkwRe9:YvXKXJYpW7bOGBS8Ukee9
MD5:	6789DA7F99BB2740D27D2083D2BF76AB
SHA1:	5CF7AFD6F038EBE63F8BA47153A572C2E8ECC42D
SHA-256:	DAEC47B01E8AA510AC5A6007DC49E2E9B49E7CB9AEBA747FBC651DABDF1FFBC1
SHA-512:	C76CAE57A9E5AA6E5756F5CE1484EBACC3ECF646C2BF78F547C8501D5CF032B42ABD94B029BC968B99595AB90FD287782DB1724582E514D8288D2020DD74C0F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258104258065286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJf8dPeUkwRe9:YvXKXJYpW7bOGU8Ukee9
MD5:	F41CE298E9CABCA43BB4CFD3C2B51BD8
SHA1:	002335739F8CE8E2EC7934D832C894A1EA83F494
SHA-256:	45C7DC8E0C22591688FF68259B27FF27246C180AB6376A06C3F32911C0695AFA
SHA-512:	3B6809C4FD4A7B4E26ABDAE7125F4BA88635B10DE8358556B6D3A0442DA54C64DD58E2C4F7DD3BAE111A85BCC92E07952B61AF6DF1E89A1E2C0BC5CCA7B1CA79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.259798892583392
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfQ1rPeUkwRe9:YvXKXJYpW7bOGY16Ukee9
MD5:	0D8452730074947E156C6BC890843868
SHA1:	3C53FC88718111BE64D25996A117EFBFD96ED2E8
SHA-256:	047FB7D9AF11F52731EE35D7EB6E6BE5881611EF8AA2AE3698CFB9E11A14F250
SHA-512:	58E68B13B2EFA7D80076E2834C926D25F9092AE8F53847427FD25BB9CD3A648A2276211B55CF2624D3C4FABA12D92AC8C07179C2327673D2D5F7DCED106468B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278570632866645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfFldPeUkwRe9:YvXKXJYpW7bOGz8Ukee9
MD5:	2E0F07C58C0456AE853C73050751FAC0
SHA1:	699CF163A8F0C0E5273C57448C6B829F23A67D6F
SHA-256:	36A155E59D3BB21A6D7C48F9FDD224A487470072EC73768893A5D8B6528CF181
SHA-512:	67BECD4825091FD3A3AB90B3ABEA324FCC3A12C17F0088D07D5064215DC29D24CFDC6A707CD54F3AA38D26F7AE90316D5EEF7B8AAEBF0453C639C36E57C3D004
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.738989371531645
Encrypted:	false
SSDEEP:	24:Yv6XqieKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNLT:YveeEgigrNt0wSJn+ns8cvFJtT
MD5:	76CD49B8BA3313853E19E95E961658AE
SHA1:	C6831C2512A5618543A6E2398CEB481DDB9A8CB4
SHA-256:	99FAD88090EA3B5476455DFAE4D46257FC511540E0B08EBD2292D275E4019464
SHA-512:	9762A52431B7F01DBBB6B5EF442038A96971DFCC8AECDD53C5C37AB76FE681B802342CCFE01D808DCCDD9134D8115181C7017AF2958B82B6FF6DA2345CF1ED59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265020577234602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfYdPeUkwRe9:YvXKXJYpW7bOGg8Ukee9
MD5:	0A591AEE806BDFCF906DE8AD9D970623
SHA1:	D6021FB3AD176FDAC60C602B186F49B5B269B690
SHA-256:	A07AF7B90295504E1651178FF57341E13F986C8DCDB1A4AAB6F8834FF52260D7
SHA-512:	5902854F20D387B0E02E28DB68760BD5FFDF51FBE571CC93166D86394CA35C27C7772D3A7A118997A56BC444D50F0A372F2170BCE9A4A15BE3F6CE2F19AD65A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.774659949710536
Encrypted:	false
SSDEEP:	24:Yv6XqiVrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNzT:YveVHgDv3W2aYQfgB5OUupHrQ9FJBT
MD5:	746BD1E29F781FF321E64033C39AECAE
SHA1:	114FBF1545267AA90AFD0F758F8BCFB20496AAD1
SHA-256:	C7633185864B009D6E1A9C6D39BABE7A99FDE93EFB848506D24DD10A80F11C06
SHA-512:	01EEA77195903CB73D14B7E69424E7392136CEDA3775756F4EB79C5FA44B20B4968EC17233528841A9F909BC799DD3CDF1B2C6591102B724713205FAA3624805
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.248808083312353
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfbPtdPeUkwRe9:YvXKXJYpW7bOGDV8Ukee9
MD5:	C6EF30B0BC16C5FCCBE67F8E97D40874
SHA1:	1D7F25BE003D1FB14FB4FAF74FE3B2B14D8599E9
SHA-256:	02CAD9B64A7CB3A6E9D2F02C1AC0D2868D4CCCA563F2E421D5E293C81D5FCB09
SHA-512:	78F996E67710BDE63BA31D28D1B7F9A4B2DE6972AF0B150AAFA685E399B333284FBF808076C01714816671F1189452A48D021B92D5852ECC9EC441A14FCC2BA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250293000735096
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJf21rPeUkwRe9:YvXKXJYpW7bOG+16Ukee9
MD5:	55766023B15ECECA585CDED77C743542
SHA1:	4DFD533C6B38EC987AA7C81808A0ACEDB2C63453
SHA-256:	A51506F1D77389EB6BDA388A57F831A95E2B80D0D12FD466D11B3840B3B094B1
SHA-512:	1062A13D5FD5B8709D1ECA512D7B5BCCD48BC651F0A75EB182D666328BA49637CD64A39207BB2C5F18728554C7289B5CCAA827F06F5C7D65EB866A22F1636505
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27185570599275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfbpatdPeUkwRe9:YvXKXJYpW7bOGVat8Ukee9
MD5:	8B3B6F6A5845BCCD698FEB535AA297F1
SHA1:	EEF85B79CE8746436701D62580CD028454C11454
SHA-256:	4509900E7721D26E2303D05243D347F332C3736E666185FA1C124FAAAA8D85D4
SHA-512:	C8D244FED744FB3B626B20FDABCCB0F02F478D7E00262610835CB0127E250142198AB8DD23CC9915355576CD4E04B724482D3617D083AB10AE16C5A13C2E2FDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.225504909747001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQeymAnJx+FIbRI6XVW7+0YRL2xoAvJfshHHrPeUkwRe9:YvXKXJYpW7bOGUUUkee9
MD5:	7AEEB364B0160DA4374741D2F55AC44C
SHA1:	C6998F9732B9BE03589C3BA3A2D64AC9F6B46AD3
SHA-256:	D1F8ECAB96A7DE303B860A8D7D4F7B93546F16EB12F359F40348AE0A66F81A0B
SHA-512:	A7DD7C6BC7E52880B6682E75B49F294F83E775A7417063D7DF1A81BBB0294B4E9D7970546BCDE4CE4F9DCCCC50B567E07F8F607244A8D424FF08A4C65EA50C09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.363137750986997
Encrypted:	false
SSDEEP:	12:YvXKXJYpW7bOGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWvU4:Yv6Xqi8168CgEXX5kcIfANh+T
MD5:	2BFB02D9F3E3CA0E701DBFBCDD4A2F1A
SHA1:	993B1790B3EC4B68A7BDA9072A401BC226A0D724
SHA-256:	5B01247826C45D3F89F7E32976134DF6104061EAB504CCFA6FC84BB010A74DCA
SHA-512:	4177B7BE374B9B2F0335758BE25F1DAC1CA91C87078D0E1307C800489C63F15A8700424ECA7D2EF724FE47EF2B33998DC1E235527747233AED175E7B161A6FF2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"454b5a70-4a04-4583-979f-505d6eb70e7a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714330738587,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1714151533618}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133234920222021
Encrypted:	false
SSDEEP:	48:Yrq5HFc7zz5Vdk1H6e1aMZefZMYS7q1pf3DeA97Kjk9:Mey5kaueRsuT3v+y
MD5:	600008DA477893CD2F6093DB5B2F0DB1
SHA1:	6E1DD2F13C6B3E3A9E5BE59AC25EA9D71AA538B4
SHA-256:	9E34E138A775796C45DA74D3FFB4DE2C4D32A51FC8C260213B03974961F58E15
SHA-512:	C6459A1C17C1A7D0DDE9B9DF77364B17D755FCE3F7B199E7B7C07B17E1196A304A83F407DAC1811226E73BDA5F308FD0D470620CA4E6A61B7D583DCAAE61B6B0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0dd225af32d9a53db23f441d83406d45","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1714151532000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d9243140a2830bc2fa084eba4293e6b9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1714151532000},{"id":"Edit_InApp_Aug2020","info":{"dg":"d446f3687bc69f890ad6527326d1d0ce","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1714151532000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"c60f01bbeac8de6d6d8ea1e0ceca4d64","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1714151532000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4597f952612141d4e80e30da2ff2e3d9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1714151532000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c6962e2f0d2b9bbc2408cbbdb795cc47","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1714151532000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9837025427689697
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpsKcv4zJwtNBwtNbRZ6bRZ4TKcvF:TVl2GL7ms6ggOVpshgzutYtp6PWh9
MD5:	3CBD8E2BC234833C437517CD810186AB
SHA1:	25EEAAA8A095E4702B16497D79CB27E5EBC6022C
SHA-256:	780931588A03AC6C8E9BD1F508D2C71A5A647C80BE5FE199EA28833EAEC4D8ED
SHA-512:	1A918C4D9F702AAA3DB74AE816865024645DDDB7CB1A703EF679FBA8B92FA2086010DD56C69D4BDCB963F400D248947AE497DB8163D7ACD1B82745B2413D7811
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.337592402844748
Encrypted:	false
SSDEEP:	24:7+tXAD1RZKHs/Ds/SpsKcvPzJwtNBwtNbRZ6bRZWf1RZKBqLBx/XYKQvGJF7ursv:7MXGgOVpshHzutYtp6PM0qll2GL7msv
MD5:	93DFF1D36DF2B90FFC194BBA8CF708D3
SHA1:	AE9CE280B33880B7CDCD63055F2B77A42121949C
SHA-256:	EE0C6AD8642C88FAD72B7C50CE2AD5413182DF02E1195EC55F6E4596B3B33374
SHA-512:	75A9848CFBC5A2C7D2B9ED75EFC6BF1C512E57CCE1ED5180675CFD89D7E10C0A58A7202B56A0D8EB68940A336736E64CAAF540685F7793F27C4A44BD5F3FF46A
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIa1b6f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mdWaslR:Qw946cPbiOxDlbYnuRKv6lR
MD5:	8ADF616DAA97639178F98192307C0F9B
SHA1:	D3C4ADF3DDF45F242A2B27FCD44C580789AF8912
SHA-256:	BDCC87B0CA4AEF267E2E91DE63120675450F51B1BE812D961460368F3578E61F
SHA-512:	65DD0F91E3ECD0B848CE793370120010426B1028EBA7D98EE53F499AB0A340A1058DCB6B6A4658E4D1EA849FFC7B53A3E5C7CEE947B197BB06EBA6D968B5EF7B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.9.:.1.2.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9shh061_pkd97l_47k.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PDF document, version 1.6, 0 pages
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.055153646477763
Encrypted:	false
SSDEEP:	6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOF6HR76HSLCSyAAO:IngVMre9T0HQIDmy9g06JXowClX
MD5:	D5C83801595FFFD6BDDD6C007326AE8E
SHA1:	2D423C89A7842E90A44D7D03D9A0115138509715
SHA-256:	677BEAE08149DAD72ACE47C63A3D2A3F4969E3EBAE56DDE85E59A0615C09DE3F
SHA-512:	A7496ED6D578AEFD22360682760064029AFEFABFA88C5E8909626620A2EF6BA1977BA219EEAD8BB063A8F9FA13F02E48AAA2F2E1686688323690CDB6B2C46543
Malicious:	false
Preview:	%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<F96814B04824AD49B8351690858EFE28><F96814B04824AD49B8351690858EFE28>]>>..startxref..127..%%EOF..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 19-12-09-055.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	16603
Entropy (8bit):	5.379517942419515
Encrypted:	false
SSDEEP:	384:mmCLCyn2zEXytF8WICmMOEZ5WUIKO6tvcJ3F5Hq6mRLu9Y1F+bGDYDibacTgnv7c:eyD
MD5:	E2139A06994A02DB4442A152D7416EE0
SHA1:	175F46D6BF5ADBD6D4FE686897DD428B4C38FDE7
SHA-256:	61E7466D5006D23E575C60CDAA27B95956F939746757C9D3EA73D48CE9C8FA3F
SHA-512:	6976709C7B68A3B173481BDC756A49044ED6C16E0728D54440D9FE5C29E7553AF9719E5A28307E8786347629AD16199721629588FDF3362773C2D9BBD6943B81
Malicious:	false
Preview:	SessionID=51388d1e-b58c-4e26-aa54-7b72f76c4329.1714151529086 Timestamp=2024-04-26T19:12:09:086+0200 ThreadID=7352 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=51388d1e-b58c-4e26-aa54-7b72f76c4329.1714151529086 Timestamp=2024-04-26T19:12:09:116+0200 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=51388d1e-b58c-4e26-aa54-7b72f76c4329.1714151529086 Timestamp=2024-04-26T19:12:09:116+0200 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=51388d1e-b58c-4e26-aa54-7b72f76c4329.1714151529086 Timestamp=2024-04-26T19:12:09:116+0200 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=51388d1e-b58c-4e26-aa54-7b72f76c4329.1714151529086 Timestamp=2024-04-26T19:12:09:116+0200 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29845
Entropy (8bit):	5.397928295586638
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbc:Y
MD5:	3B6E9FE973B32A2B9EE0F549AF3B24AB
SHA1:	A4D6CFDFA7D6C0A9699C39D0652EDB523E74E923
SHA-256:	7522CE8F915326A82ABB262D58071A78DEFC27B139EA79C65E5B23EFF0039734
SHA-512:	69DFFCBEF566329D44FDA5D0A53D1F6ADB6F8FB6F939779DDAE221DDBAC2DC85D480704FF4799965BA01FC0B8803A22B7E28BF4A5D8D8A71C539EECFC0E95252
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\253c33ee-1ff4-4c0a-8091-29a815e0f38a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\54a6190e-38ab-488d-b239-9c5f2d7386f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6da7ec4d-6c78-4b53-ad3b-c649b9e57614.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\75209940-4869-400f-b86c-39d2f3817bc4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:12:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981683763824568
Encrypted:	false
SSDEEP:	48:8IdPTn7fvHBidAKZdA19ehwiZUklqehTy+3:8Yvfrsy
MD5:	A8ABA3D91102CD9EB190FB65702AAA39
SHA1:	304FB6B1D80ED8CF55CD3F17C73574A1FC087A0C
SHA-256:	519F6C3621851A920F1959D6DB0AB287FE41D82824354CD386190884B5FEED7E
SHA-512:	D5ED8BFF812E0EA3ACB3AE9905C50D1F35E2D69BEB9F2918EA57EEE7C9718F668284B0092E707363906AC163338544F8606D3482EF5010706760A3FBAB19D80A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....a.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............a.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:12:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000865314016012
Encrypted:	false
SSDEEP:	48:8HdPTn7fvHBidAKZdA1weh/iZUkAQkqehcy+2:8VvfZ9Qxy
MD5:	968DDD53802BCC90C04AC8C3D9587A2C
SHA1:	34B9E189B0722779F71BBDB6A7A1E5D49DDC5E8E
SHA-256:	3BF430278DECE3AE69A052C29C5B04217A6395D05078EDE42D9EDC027775897C
SHA-512:	F8A9D8753480B9EB4D1BB6E777550B51C7F240653142647DE74BF371F2BEF82921774949D52802E238E07F33A8526D2A08CADA50EF8731E5FDF09B5BDFC34E27
Malicious:	false
Preview:	L..................F.@.. ...$+.,....!.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............a.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008375381362702
Encrypted:	false
SSDEEP:	48:8xudPTn7fsHBidAKZdA14tseh7sFiZUkmgqeh7s6y+BX:8xivfonoy
MD5:	AB9019D55721E2953CF6FB67F527EB48
SHA1:	378066288101776A6647A9064CB9B4DF563DBF29
SHA-256:	00425C2316C1C5635B995AB74156FC51A45997B0F48953743FBD646066CE5650
SHA-512:	EDD1CEF01B6D5A68B57C4CC200975B768329A49ACC508AC7745C291A477979F5DDCC5B2BD3EC8A49801A6CB640595C70F38DD60ECDE1A8BFFD34BCB2FD9294BC
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............a.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:12:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9966482115888042
Encrypted:	false
SSDEEP:	48:8UdPTn7fvHBidAKZdA1vehDiZUkwqehQy+R:8Uvf6iy
MD5:	CC6ADE7A9E0233485B0EAFC6F4E97487
SHA1:	4929876D2E48A6D58C0BB76E072E18174F3FC628
SHA-256:	E33BC804F1B5D27362F1F171148507D0D672723AD0CA6747C5F019E99F55B9A0
SHA-512:	9CF86641CA851843095C8A62CF9EEB8720DC3F271319C21E99DEEBBB7344D4CDE9C7969F284E98CD105E87E53BA75FBE5414C3177F687F355C9C5E1D3068D44A
Malicious:	false
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............a.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:12:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.98597551697643
Encrypted:	false
SSDEEP:	48:8wdPTn7fvHBidAKZdA1hehBiZUk1W1qehWy+C:8Avf692y
MD5:	890779FFC50575114A04ED85F223CC14
SHA1:	CF9009948582DB0F82D44AA08109B777A1F610A6
SHA-256:	9B24377C553B679969D2480E8E2C734FE57162B0A17C5CEEC1733DD15CAE32D9
SHA-512:	3835C7D50A8CC8B946839FC255FB373E811CA8FF55FE67E04565E24F7783147E9F22A2774F53FE9DA4936F5D787B388942476C3D8A2CBFB292F7F8F63E0CAC57
Malicious:	false
Preview:	L..................F.@.. ...$+.,....g.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............a.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:12:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.996265498515704
Encrypted:	false
SSDEEP:	48:8+dPTn7fvHBidAKZdA1duT+ehOuTbbiZUk5OjqehOuTboy+yT+:8SvfET/TbxWOvTboy7T
MD5:	A144E4B2CC0A6FA7CB648C20D748C75F
SHA1:	4A297AA00E053368AD2EC4D9B3A4A5D421D8483A
SHA-256:	1051F85618C4C825ABD1599452C7E5A74868C163C40BB01886C908F65CB8ACB1
SHA-512:	910B019054260A5E511E9B2C786EDA75C06E039E414E5F13C87EF46E7D13CF57108437A37065A0652B790135D77816655DE20699CF9751B4027355DADFD64517
Malicious:	false
Preview:	L..................F.@.. ...$+.,....2xv.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............a.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A18%20GMT&n=-2d&b=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<html></html>

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (945)
Category:	downloaded
Size (bytes):	131882
Entropy (8bit):	5.376896897488642
Encrypted:	false
SSDEEP:	1536:XtTqru1xouE1ZTnPrMiY6WRdA2qZpXnBnK3xsVdFE7zptEvp62kdS6F:JmuWl7ndK3xsVdKEd56F
MD5:	64141792105EA4861F9F33294D65AB81
SHA1:	506D9100CAA070005A890BD496DE64C437D6D008
SHA-256:	21758ED084CD0E37E735722EE4F3957EA960628A29DFA6C3CE1A1D47A2D6E4F7
SHA-512:	30E0A9AA84688AC093C09F2F41089C899BF4A9CA5138289D7A4DC64C54BA293936FB2EE6BA724894A09590509863EA7712B6055C28E61639DF4D34520B538759
Malicious:	false
URL:	https://edge.xero.com/common/react-dom/18.2.0/react-dom.min.js
Preview:	/*. @license React. * react-dom.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /.(function(){/. Modernizr 3.0.0pre (Custom Build) \| MIT.*/.'use strict';(function(Q,mb){"object"===typeof exports&&"undefined"!==typeof module?mb(exports,require("react")):"function"===typeof define&&define.amd?define(["exports","react"],mb):(Q=Q\|\|self,mb(Q.ReactDOM={},Q.React))})(this,function(Q,mb){function n(a){for(var b="https://reactjs.org/docs/error-decoder.html?invariant="+a,c=1;c<arguments.length;c++)b+="&args[]="+encodeURIComponent(arguments[c]);return"Minified React error #"+a+"; visit "+b+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}.function nb(a,b){Ab(a,b);Ab(a+"Capture",b)}function Ab(a,b){$b[a]=b;for(a=0;a<b.length;a++)cg.add(b[a])}function cj(a){if(Zd.call(dg,a))retu

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (49273)
Category:	downloaded
Size (bytes):	49276
Entropy (8bit):	5.46054574462855
Encrypted:	false
SSDEEP:	768:TCoEqoinIC7q2gh0CKUxEGWUwcvXWP6Ta8vHKPPSvCC1anVD//B/ZX8RNIB8HxKg:TPJi0LUxEpyv0StEZ/Bd8RNIsxZ
MD5:	FB2E085CDC32D0BC97C24A8A82C12946
SHA1:	194A95809592E6984151A465946EF7EDB7A47959
SHA-256:	6CC4C722A50B4152194B13E7E3C8A1A5A5F23B17988F8FA85404394EFC5C0984
SHA-512:	D9399F04E6965CC59C6A730F85E10DAF949A0BDA30DDE85710A27380650F8194362CA51E28C8D751B3B4F23C451715B14F2A3A1AB9F872DE8B3202F8F1698B0A
Malicious:	false
URL:	https://snap.licdn.com/li.lms-analytics/insight.min.js
Preview:	!function(){"use strict";function t(t,n,e){return n in t?Object.defineProperty(t,n,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[n]=e,t}var n,e,r,o,i={ADVERTISING:"ADVERTISING",ANALYTICS_AND_RESEARCH:"ANALYTICS_AND_RESEARCH",FUNCTIONAL:"FUNCTIONAL"},a="GUEST",u="MEMBER",c=0,l=1,s=2,f=(t(n={},a,"li_gc"),t(n,u,"li_mc"),n),d=function ar(){var t=arguments.length>0&&arguments[0]!==undefined?arguments[0]:null,n=arguments.length>1&&arguments[1]!==undefined?arguments[1]:null,e=arguments.length>2&&arguments[2]!==undefined?arguments[2]:null,r=arguments.length>3&&arguments[3]!==undefined?arguments[3]:null;for(var o in function(t,n){if(!(t instanceof n))throw new TypeError("Cannot call a class as a function")}(this,ar),t=t\|\|{},this.consentAvailable=!1,this.issuedAt=n,this.userMode=e,this.optedInConsentMap={},i)t[o]=t[o]\|\|c,t[o]!==c&&(this.consentAvailable=!0),this.optedInConsentMap[o]=t[o]===l\|\|t[o]===c&&r===l},v=(e=[i.ADVERTISING,i.ANALYTICS_AND_RESEARCH,i.FUNCTIONAL],r=[c,l,s,c],o=new R

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1464x1464, components 3
Category:	dropped
Size (bytes):	37112
Entropy (8bit):	7.831600430771858
Encrypted:	false
SSDEEP:	768:J57ICDGZKvsaAhWZ38R2a2ZLjzgzQP5dkgAIJVSElIaxIMq:J57hDkaAMZ3kiBgoRbJVSEyyq
MD5:	EDD03DFD0473DA2D1C74126725EC45A2
SHA1:	0203304DD62F4778AC22EAF179669DD0DC5A7B26
SHA-256:	FB727F6C6B975737DA5A5ED7DD4B8290A9A4433C0C1E7E7D80CF1AD433F49949
SHA-512:	C9C06D4F8D053CBCF931CD5F1791EEDB2C23BCDD51CDDAB3121816FB87D94ED220FE987635FB282B6768D826DC34590DC2D3CE42B42C4DE8E165AA17E9FBB676
Malicious:	false
Preview:	......JFIF..........................................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F............................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F..........."..........4.........................................................................%U.YH...e.......IE. ).B..&P..T..D.YDQ(.R.L. ........(........YD....DQ)....R....A.B...B..)..@.`..@...\.9...J........AP.)......%..P.R. ...@X....R.(.P....`..P%.......%.R.`.K..P.,.. .,.......D..l...(..YI@..T@.".".R&.2...(.........DPe....-..Q.%..PX,....J..-J...)P.1.........(..HX.P@d.J......@,.H.Q...D...T..PBP...()....Ir.X...E...QQ.E...(,..PX.....cl).......YH...T.......)...(.T..X.(.E..J..@J..`). ...B.U.AD...........X,....c.P.....,.Q...%....),"..AR...... .........).R.`.(%..2 ,....X.e...%..(.D.@)....*P.DUJ..U.X.-...........`...f......P.....%B......@..PX...(.%Ye"......R.,,..P.....B.`YD....."..B..&@"Q..$.. (.DP...

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	86
Entropy (8bit):	4.7092327439724695
Encrypted:	false
SSDEEP:	3:YTyLV/VffcB+xNVcSLQzRE9LduUBjd4:YWLV94iDLQmpddB4
MD5:	5143820DAEB644938735D6B28C0059E7
SHA1:	22316BB57B4FA755662FD6F5FB7F749B21AC32A1
SHA-256:	740BB313221BDA5543B6FBE0BCE3DD276CC70C4FD9AA0BAE9D46B149406BECF5
SHA-512:	ABABBC2935D02EF31FA6FD14F56CF781BA8015A0DBCF8AB05CC7CFECBCABCA4B2B4E37B5B0BBE0341948DA7902613F4BC7EEA1C1FB8E9D142B3EC1D61084FBA6
Malicious:	false
URL:	https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_ewwvmnuh_telemetry
Preview:	{"version_hash":"581d359d","url":"https://www.redditstatic.com/ads/581d359d/pixel.js"}

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1464x1464, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	21790
Entropy (8bit):	7.986928709826565
Encrypted:	false
SSDEEP:	384:TiuvW7Gvr/qLuKVTg4TjuUOCPekh63JHf2ncgdcgBiqm3nAbg3NXkFnYyps:TiYtv7qLzg4Tju1CPxcuncgdcgBi/uFS
MD5:	7187D23CE16563C985F749B7C969955F
SHA1:	C3BFD906007C66A666EE85BEE9C523EE17A3A8FD
SHA-256:	5DC3B7D1C8F34A7E8B4FFABB37E94CB7F9AE84808A16CFBAAA849A037E71FF0C
SHA-512:	7E6B84B2A3D810A084631C6E476DB1934F2710A37D057AF89EAF09FD0BB7F3453D2702B25E517C5F69481BEC7FCA3AC2AB75B288905C85B5A5824B9AA54A0C49
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/features/quotes/Quotes_hero.1646877478435.jpg
Preview:	RIFF.U..WEBPVP8 .U...........>.t.U).0(..x.`..gn....r.'=M\..8bdo..;....rs..S.:Z.6......g ._....n?....>.........Z............_...?[{.~...........c...............E...........K.W...o....".!N.}w..w....L......A.w.LZ....iwCL.f-wCL.f-wCL.f-wCL.f-wCM.....3...3..n..km..>..^v.4.I.WV.:....g.1l.E3....X.]Xh..Z]..p:..O.........>..]..>..P..%.3.u....]..>..]..>.".S....[+..I...7;Xir..x..''t4..L...i....}.wCY.......g.,4u'3j^.g.,4u''t.~...%..4^m......0.....S....wCL....s......-wCaMI.....zX...3.Q.dl.~...$!.Bn,...F..i............SUi...eua..P`2N.....w....F.....x.O..!9;..\|3..Rt(...S.....=LZ...Z...hon.3H.:.t6.:..I..E.7.....A.z.....g.1k..g.1O.R..ry)..}..>.A..I.... .45.Y....@.rwCP.o..m..g.3.C.1k..g.1k.....`9....Q...<.$/..W...CZa....xYA..Z-.2.....b.....a....4.......L.f-\|.?.....(.L8.x?.:.u..K.8.I...VH~J.I...3.CK..Yg.^lK..S..j;...E:.&j...&A`....W..)xj=.x,.....!\.U,.2....B.......=.B./.%........E1.%.n...Mo\|.......fI..9...JR}.g........v.....6.....?

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=206915&time=1714151627758&url=https%3A%2F%2Fwww.xero.com%2Fus%2F
Preview:	{}

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10978), with no line terminators
Category:	downloaded
Size (bytes):	10978
Entropy (8bit):	5.2355898199692
Encrypted:	false
SSDEEP:	192:xC8L2j7E9Ma7qS1lEpLqtP48nIGBIGAGLYsi/+Ihi0iybVEZUHO443blABEuWU2n:xCq2jAya7qS1lEpDfJZsimI1ifi4L2+J
MD5:	553D27144D4F9FBE7E31B802107A2071
SHA1:	C8B97A2504810C05288497B1A0CAC5C4654299DC
SHA-256:	F1249E3503B8A12598E09882E9DED38155AC212298143DEC459CE6820C6D3F37
SHA-512:	B794B02774E574C0D923F1530712BDEDFC5370036C15A525DAC807361900490DBCAE7B2547029DC7CB830D4EF43AD31CC5DBBCE0C2AD14B01D8AA74A0D092952
Malicious:	false
URL:	https://js-agent.newrelic.com/page_view_event-aggregate.06482edd-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[786],{777:(e,t,n)=>{n.d(t,{e:()=>r});const r={}},5998:(e,t,n)=>{n.d(t,{uB:()=>h,wu:()=>l,zJ:()=>m});var r="Start",i="End",a="unloadEvent",o="redirect",s="domainLookup",u="onnect",c="request",f="response",d="loadEvent",p="domContentLoadedEvent",m=[];function l(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},m=arguments.length>3&&void 0!==arguments[3]&&arguments[3];if(t)return n.of=e,v(n.of,n,"n",!0),v(t[a+r],n,"u",m),v(t[o+r],n,"r",m),v(t[a+i],n,"ue",m),v(t[o+i],n,"re",m),v(t["fetch"+r],n,"f",m),v(t[s+r],n,"dn",m),v(t[s+i],n,"dne",m),v(t["c"+u+r],n,"c",m),v(t["secureC"+u+"ion"+r],n,"s",m),v(t["c"+u+i],n,"ce",m),v(t[c+r],n,"rq",m),v(t[f+r],n,"rp",m),v(t[f+i],n,"rpe",m),v(t.domLoading,n,"dl",m),v(t.domInteractive,n,"di",m),v(t[p+r],n,"ds",m),v(t[p+i],n,"de",m),v(t.domComplete,n,"dc",m),v(t[d+r],n,"l",m),v(t[d+i],n,"le",m),n}function h(e,t){var n;return v("number"==typeof(n=e.type)?n:{navigate:vo

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4643), with no line terminators
Category:	downloaded
Size (bytes):	4643
Entropy (8bit):	5.138344600303313
Encrypted:	false
SSDEEP:	96:lbD/Xk7xbyMDjyeJh10KdBVDb7a76SylPTMqqZqBcfHqmxJ/7Zqar:lb7U1rDjD/0Kxa72FqZquHqmnzZqar
MD5:	8862791DEBD0B259297A0CCF618932EB
SHA1:	9E4947BAFF917784CBB4E3274EFBEA1609EEC5D4
SHA-256:	0B09C565BAA3B8D3DE7EA5B132E22C0ED1BB8943AE83D1BFF9421E62AE8D8800
SHA-512:	682A6553AC191FE020080C181AC16389898C8D3E7AB4A3FD384C3697021BCBFD8300FA6A7B155CCC2F2FB6C4D4E202F56C2E247677270D9600D8B30FF52BE868
Malicious:	false
URL:	https://js-agent.newrelic.com/page_action-aggregate.ac76d497-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[78],{2573:(t,e,s)=>{s.d(e,{o:()=>d});var i=s(4247),n=s(1117),r=s(8673),a=s(8310),o=s(5763),h=s(3860);class d extends n.w{constructor(t,e,s){super(s),this.endpoint=t,this.opts=e\|\|{},this.started=!1,this.timeoutHandle=null,this.aborted=!1,this.harvest=new r.M(this.sharedContext),(0,a.L)(this.unload.bind(this),(0,o.Mt)(this.sharedContext.agentIdentifier,"allow_bfcache")),this.sharedContext?.ee.on(h.wO.RESET,(()=>this.runHarvest({forceNoRetry:!0})))}unload(){this.aborted\|\|(this.opts.onUnload&&this.opts.onUnload(),this.runHarvest({unload:!0}))}startTimer(t,e){this.interval=t,this.started=!0,this.scheduleHarvest(null!=e?e:this.interval)}stopTimer(){let t=arguments.length>0&&void 0!==arguments[0]&&arguments[0];this.aborted=t,this.started=!1,this.timeoutHandle&&clearTimeout(this.timeoutHandle)}scheduleHarvest(t,e){this.timeoutHandle\|\|(null==t&&(t=this.interval),this.timeoutHandle=setTimeout((()=>{this.timeoutHandle=null,

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17191)
Category:	downloaded
Size (bytes):	17990
Entropy (8bit):	5.354726453130202
Encrypted:	false
SSDEEP:	384:sJ57bov6hzkglJVv6p+wF3g/d28bH1cCFTNAU:sJuv6homwF3g/dFcCFTX
MD5:	41E0E8820759010531CD51D87C35E16E
SHA1:	0E7D20F7869471CCC3C59556D739FEC8F531123A
SHA-256:	6C336D0AB0B24D0C9FFEA2FD5D2048D2BADA2732824A6BB0EDCF5478D5FBDC92
SHA-512:	3056D30DAAD6754A018DAF3F3240F1B9249938E5AD200D602A4F9D2965DD8F32ED1AFE37A6A01C2B843AF1D3FE3BBEC806FED5DAD908651014ED8CC638CB8222
Malicious:	false
URL:	https://tags.srv.stackadapt.com/events.js
Preview:	(function (w) {. // Begin doc.. var is_dev = false;.. if ( false ) {. is_dev = true;. }.. var disable_sync = false;.. if ( true ) {. disable_sync = true. }.. var tip = "vXWsi08RD23wTgnKpgUgbhB7JXI4vmEK1GgaqNrbRNs". . var userIdCookieValue = "s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY". var userIdV2CookieValue = "s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw". var userIdV3CookieValue = "s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ". var campCookieName = "". var campCookieValue = "". var campaignCookieLiveDuration = 7776000. var userIdCookiesLiveDuration = 31536000..var globals={load_num:0,init:!1,addr:is_dev?"http://127.0.0.1":"https://tags.srv.stackadapt.com",aid:"",impid:"",default_params:"",landing_page:"",secs_passed:0,tec_secs_passed:0,hidden:!1,host:encodeURIComponent(window.location.protocol+"/

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.054229296672174
Encrypted:	false
SSDEEP:	3:3xuq3XW2C2Y:xn5O
MD5:	638FB29357D49E9A9D2889229043B078
SHA1:	C29D1B77328F39D6F2C684E33C15E61A647BAF52
SHA-256:	0FED1E72D393247E450EF385EC24D5D885A472F8CE3451F4DCC35E5C65470D25
SHA-512:	71202F7B2258706E1DCB28C840FB92AB60E4DFB542CC435627FEE812920B2C206BADFAE5FBF816EC225AD641938F0853DF8A866E95A09DD1056C04A34708F889
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnWdQflcJtVfxIFDXhvEhk=?alt=proto
Preview:	ChQKEg14bxIZGgQICRgBGgUImgEYAg==

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<html></html>

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151696607&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	14186
Entropy (8bit):	4.85225145795087
Encrypted:	false
SSDEEP:	192:dpCW2jl35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM3Zv4UFG4e:fCWgov96QQFhjl9FoNAsrnM3Zv4d
MD5:	EB92B9A2C0C61C675C9C4AAEE39B37FA
SHA1:	4A51016261CA3F86912C12F5F52CC537FA5CECB1
SHA-256:	963B938AD700D468396A1E28AF4C3BBE87D7B2C97C29EC5F3DB430CB56A77EF1
SHA-512:	06D2A3870698C9519EA5F02F60387A9421D69D3DA7E7E4EE80F2839F8725AB58613CC0ACE80DC18127CE67F87D8736854DD8232EFE2292FB71D7ACF6C9FE7986
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/signup/growing.json?next_id=1712725399
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"Growing","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":true,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"1","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Set up your subscription","description":"Add your payment details from the Xero dashboard."},{"heading":"3. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["Safe and secure","Cancel with one month's notice","24/7 online support"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","promoCode":"SPRINGSAVE60","@id":"content--909067596","signupLocationInitialValue":"US","planPr

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3054), with no line terminators
Category:	downloaded
Size (bytes):	3054
Entropy (8bit):	5.948157427548198
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08eE4uHec8pQPJG/FzzYOh+k:wsbSUtJfxrqLWWWdV6j1qE4Tc8pznhD1
MD5:	5BB9F912BD091B8242524ADAF3B4A000
SHA1:	44807CBB404F4F7A73E9E23DFA472A5D3A7BCEF8
SHA-256:	35566CA723F3236F5C9B58705502793350043B156B639F5F9908704826352ED8
SHA-512:	A045D32F4E2A72F319041FA8EE50C3D3C5868AAEB07D37FE41CC6522C0BF61DE61576AE94501041B3315404810D5DEDE3B1239DC7BAC541005BE0A30711A6A37
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/1023673485/?random=1714151590811&cv=11&fst=1714151590811&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<html></html>

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151661107
Preview:	{}

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	206885
Entropy (8bit):	5.833364094589992
Encrypted:	false
SSDEEP:	3072:9rWgBvhDJdT1SQwCReAWBUAOepO6CHJNzAVYazvePAnowKGjgqU3:P7nRRpWBlpO6CHJKVYabeUopGjrU3
MD5:	EBB1B6D57148B1E2A8F687ADD5D372E7
SHA1:	FEBDBE9DD26D3953C732E3A8F9522382A319B099
SHA-256:	818B8580C7436C9300DDCF9EA3F2EB3915170FCCF2952727D1D06019B9F12859
SHA-512:	B7709EB7E2596A370B07FF86DF2CC30E16F925D9BEEA10C44FF4BBFD921E0DCE12899228FA2DD9A8D5A6C401DDAE59D40C628374C17F451B019C4E2FA26FA517
Malicious:	false
URL:	https://www.xero.com/b4LCPhHplnVS7/z/FYF00Hq064Ysw/7h7iLbE5iu/K0ESVFoYBA/XnEOLA/VyCTY
Preview:	(function kCHxPLmMcS(){Sh();dYh();MYh();WYh();var T6h=rYh();function Rbh(a,b,c){return a.indexOf(b,c);}var n6h=UYh();jYh();var Ovh;var hh;CYh();xYh();var Bh;function xYh(){Bh=[PYh,gYh,zYh,mYh,VYh,-vYh,-YYh,bYh];}var D6=function(f6,l6){return f6/l6;};var Q6=function(F6,B6){return F6===B6;};var c6=function(){return [".Z>.&5\x40:>(\t%/",".\x3fX/2JW.+=.R..","g>>9.29.3B%\x40>.=E\f4WB.6+.","2+.D<\v\"","B=.#;^.-\x40W.-","V:.7.G2.&\x008(\x3fqU8\x406.\x00","(\t%.\'1U>D<.","4.(#G.#,\r=0\x3f.F/L4\r.6I","P.!\".","7#%\x40<\x40+.","km\x00.",".%(Y8\x40\f\t\v.","K-..\x3f^","\bA=..=2=","82(9B.\x401\v..",".V5\v7%R","i#.\n","%=\\-v!.\x072I\f)Vp\x00:!._..!.","..%509u\"\x405\t..",".j\v8","IB.+\r.S<..\f","W.6.S","6\v&.F\f%+.9","E.$\x40[.;\x006","E H9..\x3fH6.CL","XDhD","\x07.#H.7K","56","S&a+3^\|\\S$r{I-M,/<m_5vW","(<#.29","8L:V","q","/\x00(.D-)3.]). .7541",".X,\r7.[,\"","!\".<1+1]\"I1","\\.2VJ.+!.Ct\r&.F:+","53%)]+K,","2%KV","55\|^!Qx\rS,M.)A..11../.>.Q{#)L%%69..\x40..)_./Km.2!",".4","\x00>=.R7\n..U5(#

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5140)
Category:	downloaded
Size (bytes):	70468
Entropy (8bit):	5.346296584082395
Encrypted:	false
SSDEEP:	1536:RJeUwT76HXltMHM9eEqJ1UJnTZ02LKVlEyF7:RIT7OX4s9eZYtj8ltN
MD5:	B8321C009C0B058EECC63EBADE42B9D4
SHA1:	6E21139BB907D671D9F6375EF7283029C6287792
SHA-256:	AB04FAD1F2890D94A0DB635CE0C65FBE802070E0717F7EBB3D0C1877AFE4C0EE
SHA-512:	612A641876468AC4BE7DA43F2E026A79B6397D3DC21DD8754B76EF74FC2C8ACE169174EEA4095B6158F38DF7C15607FDAE9DC0124962618C8F852BE17D722412
Malicious:	false
URL:	https://connect.facebook.net/signals/config/303901320544451?v=2.9.154&r=stable&domain=www.xero.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14116
Entropy (8bit):	4.852751442895415
Encrypted:	false
SSDEEP:	192:bpJEjh35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM3Zv4s3G4e:VJi0v96QQFhjl9FoNAsrnM3Zv4j
MD5:	8CA97297BE710BC13598A924D240F6E3
SHA1:	7AC778EC5A31729472186C018050DA70BDF8BF01
SHA-256:	54157C66C194434743881750284E9840A570B93B5CFE2FBB09AEE7263DBE272D
SHA-512:	46555A2AF79C1402C48F025FB0AAFD5B2FE255F30F54B5B6D6E79F6320376549C34689F1ECA281852947B7B9B97786F00E38DB455DC51448B8F35CEE7B7F45CA
Malicious:	false
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"Early","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":true,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"1","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Set up your subscription","description":"Add your payment details from the Xero dashboard."},{"heading":"3. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["Safe and secure","Cancel with one month's notice","24/7 online support"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","promoCode":"SPRINGSAVE60","@id":"content-792953382","signupLocationInitialValue":"US","planPrima

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	14417
Entropy (8bit):	4.849944546066173
Encrypted:	false
SSDEEP:	192:OpFG5IOjU35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM0cv4LmYG4e:MF+IYXv96QQFhjl9FoNAsrnM0cv4LK
MD5:	2737D40F9DDD3635C29AC7BBC1140F93
SHA1:	192C44AEA4B5CA9E419B86BD61A6B799A199C808
SHA-256:	068C5925698F78899A720962D4F67CD0280D3216AF30A6FC0A2391575F6D64FF
SHA-512:	2EFB9037FBBFB91A0B5DCCDB26A88B4943AC3079583653B555A9BC71FA04BFD6E07F414BF4AAE7C4231A29E4DD88DFE831BA043A04ECC87B61D7290832763E8F
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/signup/established.json?next_id=1712725399
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"Established","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":true,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"1","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Set up your subscription","description":"Add your payment details from the Xero dashboard."},{"heading":"3. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["Safe and secure","Cancel with one month's notice","24/7 online support"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","promoCode":"SPRINGSAVE60","@id":"content-997853355","signupLocationInitialValue":"US","pla

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (597)
Category:	downloaded
Size (bytes):	946
Entropy (8bit):	5.368827305480118
Encrypted:	false
SSDEEP:	24:si2N1V4NxwZG1S8Sbjujz2SbjlAjzKBiSbjXY:rN3M5afhASBzU
MD5:	AB445CFE5A058863A561453F704A4752
SHA1:	0B13AE6372981EB4452D5C458F776D60C9DDE21C
SHA-256:	1542CCB600C0A52CD148094F8547A38ACC6A09A264AA53BFF9A10D238E5F6FE8
SHA-512:	CAE75D257671589C329E288AD1F18A4D434EF3D67E694B04557BF422563D7A26DD5D8F5C686010C5780AA7D66470A5F3F0E09DAFEC3F73F0F5E9F479ADBEACB2
Malicious:	false
URL:	https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/pricing-plans/
Preview:	.<html>.<head>. <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script>.</head>.<body>. <div id="universalPixelContainer">. <script type="text/javascript">. (function(global) { . var ttdcm = new TTDCM(); . ttdcm.init( ["https://tags.rd.linksynergy.com/rcs?ns=ttd&uid3=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3D1i071nc","https://uipglob.semasio.net/tradedesk/1/get?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&sInitiator=external&_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dsemasio%26gdpr%3D0%26gdpr_consent%3D","https://mid.rkdms.com/bct?pid=02760a75-50e3-4c64-b77b-fb5fcd04e437&_ct=img&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347"] );. })(this);. </script>. </div>.</body>.</html>

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78687
Entropy (8bit):	5.316950923775964
Encrypted:	false
SSDEEP:	1536:2u23v7YtctGCxcYOKlI5Ar4j4INh7XOvnM5/Q0F:W7YtctGf7XOvnMWY
MD5:	9BA23104805B0ECDD9ECA87FA3A3467A
SHA1:	39BA8C65B15B08C3DDEFA9AE671A3166F6741B5B
SHA-256:	6488F5111B301AB43DA1C99360921528DE0903E94177C564DF5DAA090744E05E
SHA-512:	08F64B80CCE6522DD3FFB695BA4944E2F1169969ED6D5350A08B87B08BF6876D9DA2DF458929383EADE0F4D200D596B677BBACB4E7DB2A58088DFD1D4A2170DA
Malicious:	false
URL:	https://tag.demandbase.com/4cdf254ff02939a3.min.js
Preview:	var Demandbase=window.Demandbase\|\|{};!function(g){"use strict";var M,x=this&&this.__spreadArray\|\|function(t,e,i){if(i\|\|2===arguments.length)for(var n,o=0,r=e.length;o<r;o++)!n&&o in e\|\|((n=n\|\|Array.prototype.slice.call(e,0,o))[o]=e[o]);return t.concat(n\|\|Array.prototype.slice.call(e))},n=this&&this.__extends\|\|(M=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(t,e){t.__proto__=e}:function(t,e){for(var i in e)e.hasOwnProperty(i)&&(t[i]=e[i])}),function(t,e){M(t,e);function i(){this.constructor=t}t.prototype=null===e?Object.create(e):(i.prototype=e.prototype,new i)}),e=this&&this.__awaiter\|\|function(r,a,s,l){return new(s=s\|\|C)(function(t,e){function i(t){try{o(l.next(t))}catch(t){e(t)}}function n(t){try{o(l.throw(t))}catch(t){e(t)}}function o(e){e.done?t(e.value):new s(function(t){t(e.value)}).then(i,n)}o((l=l.apply(r,a\|\|[])).next())})},l=this&&this.__generator\|\|function(n,o){var r,a,s,l={label:0,sent:function(){if(1&s[0])throw s[1];return s[1]},trys:[],ops:[]},t={next:e(0

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&t=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&tip=vXWsi08RD23wTgnKpgUgbhB7JXI4vmEK1GgaqNrbRNs&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12146), with no line terminators
Category:	downloaded
Size (bytes):	12146
Entropy (8bit):	5.231155936118476
Encrypted:	false
SSDEEP:	192:bQPc4wQUDqOm02bKWSxFrstl7/s0U7J30VJvnhV2F0d4oQkpRr0rzonzDZHSjfGt:bjqYvXQH7/s0U7JkVZnbnd4oQYRrKcDd
MD5:	4EF8D054860549421E884B3D2D74B83E
SHA1:	36DC9C9225A4EA86A772E1865F8125A00F4A8D4B
SHA-256:	D0D7C9C8E398100C60B41833292522F27B1E6B12C057442536FF98995D90F08C
SHA-512:	8BD9FD27A417E91E7E9A450FCDB34E34C7405DB47A5F5F9F175B76A1AAB36E932A9239F8654D55FC2E7C0702C1428AAC8DA555A7CE63086165810ADF936A5056
Malicious:	false
URL:	https://js-agent.newrelic.com/session_trace-aggregate.83105561-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[733],{9139:(e,t,s)=>{let r;s.d(t,{m:()=>n});const i=new Promise((e=>r=e)),n=Object.freeze({onReplayReady:r,sessionReplayInitialized:i})},2573:(e,t,s)=>{s.d(t,{o:()=>c});var r=s(4247),i=s(1117),n=s(8673),o=s(8310),a=s(5763),h=s(3860);class c extends i.w{constructor(e,t,s){super(s),this.endpoint=e,this.opts=t\|\|{},this.started=!1,this.timeoutHandle=null,this.aborted=!1,this.harvest=new n.M(this.sharedContext),(0,o.L)(this.unload.bind(this),(0,a.Mt)(this.sharedContext.agentIdentifier,"allow_bfcache")),this.sharedContext?.ee.on(h.wO.RESET,(()=>this.runHarvest({forceNoRetry:!0})))}unload(){this.aborted\|\|(this.opts.onUnload&&this.opts.onUnload(),this.runHarvest({unload:!0}))}startTimer(e,t){this.interval=e,this.started=!0,this.scheduleHarvest(null!=t?t:this.interval)}stopTimer(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];this.aborted=e,this.started=!1,this.timeoutHandle&&clearTimeout(this.timeoutHandl

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (30711)
Category:	downloaded
Size (bytes):	32780
Entropy (8bit):	5.286151905711605
Encrypted:	false
SSDEEP:	768:w1tlXT2sfSKsvoqSeUZbnBWNGOchEeU4176F0wP:8lXasfSq0GDhwHP
MD5:	D88FA49A30FCCA22BFCE8C8BCC3EF6CE
SHA1:	7DE11E785E49A3CE3F9CD60D9E6FEE1A126ED8FC
SHA-256:	1BA494196E649E05B9DA7D822EBB09919BCECA8870EB2E1D0DF23A72706AAA52
SHA-512:	2867C351C1CEEEB68F6C63E54FF48767769D67D8CFF6BA7886CF4D43611BEA35217C0E0BA1769AC74B934471DEB9C087B3BCC9450CC13326E50F3F21EF8C2006
Malicious:	false
URL:	https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1?utm_source=statementsPdfLink
Preview:	<!doctype html><html lang="en-NZ" class="xui-html"><head><title>Xero</title><meta name="robots" content="noindex,nofollow"/><meta charset="UTF-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link crossorigin href="https://edge.xero.com" rel="preconnect"/><script>;window.NREUM\|\|(NREUM={});NREUM.init={distributed_tracing:{enabled:true},privacy:{cookies_enabled:true},ajax:{deny_list:["bam.nr-data.net"]}};. window.NREUM\|\|(NREUM={}),__nr_require=function(t,e,n){function r(n){if(!e[n]){var o=e[n]={exports:{}};t[n][0].call(o.exports,function(e){var o=t[n][1][e];return r(o\|\|e)},o,o.exports)}return e[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<n.length;o++)r(n[o]);return r}({1:[function(t,e,n){function r(t){try{s.console&&console.log(t)}catch(e){}}var o,i=t("ee"),a=t(31),s={};try{o=localStorage.getItem("__nr_flags").split(","),console&&"function"==typeof console.log&&(s.console=!0,o.indexOf("dev")!==-1&&(s.dev=!0),o.indexOf("nr_dev")

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151627871&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/1023673485?random=1714151590811&cv=11&fst=1714151590811&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Preview:	<html></html>

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4706)
Category:	downloaded
Size (bytes):	4707
Entropy (8bit):	5.209342867580516
Encrypted:	false
SSDEEP:	96:ofqbTG9QyFgVseQCvDbGB+EvV1IjsK21LROL6sparfS8g8VHbm6/606ni1Fm9lLN:ofqXM+QYfGJ/I4KILROLVafS8lVHbm64
MD5:	8F464F6B465E1BD7C723319B980B0A94
SHA1:	485EA8FC56E26ECFF4BB20354C3998CEB64D6766
SHA-256:	462EC91DA5F13557F7035D0BEB94E88EA21E41DD1576F1A5E1CA66CCE7FC6989
SHA-512:	2A62AFE2A43D00FA57830DDBE37E0002A99FC8006D44A8C2339888E173DC84F96B293D50E01EA0F09173A05EC9BF9DC6FF6B2E9E04CF20F4565B03BAE6F59CE4
Malicious:	false
URL:	https://edge.xero.com/i6m-wrapper/1.x/i6m-wrapper.js
Preview:	!function(){"use strict";const e=new Event("intercom-wrapper:script-loaded"),t=(e,t,n)=>{var o;null===(o=window.newrelic)\|\|void 0===o\|\|o.addPageAction(e,{kotahiId:t,deploymentEnvironment:"production",...n})},n=function(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"";return Object.keys(e).filter((t=>null!=e[t])).reduce(((o,i)=>"object"==typeof e[i]&&null!==e[i]?[...o,...n(e[i],t+i+".")]:[...o,t+i]),[])},o=e=>e?{intercomWorkspaceId:e.app_id,intercomSettingsAttributes:n(e)}:{},i=async(e,t)=>{var n,o,i,a,s,r,d;const c=null===(n=e.user)\|\|void 0===n?void 0:n.user_id,w=null===(o=e.company)\|\|void 0===o?void 0:o.company_id,l=null!==(i=null===(a=e.user)\|\|void 0===a?void 0:a.custom_attributes)&&void 0!==i?i:{},u=null!==(s=null===(r=e.company)\|\|void 0===r?void 0:r.custom_attributes)&&void 0!==s?s:{},m={...l,...null!==(d=e.messenger)&&void 0!==d?d:{},app_id:t};return c?(m.user_id=c,m.user_hash=await(async(e,t)=>{var n,o;const i=sessionStorage.getItem(`intercom-user-hash-${e}-${t}

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=*;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413
Preview:	{}

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<html></html>

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688252&i=gtm&dwt=5&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7744)
Category:	downloaded
Size (bytes):	7826
Entropy (8bit):	5.385125178678939
Encrypted:	false
SSDEEP:	192:vy+A72mNNoj/BBVx69jARwSSnBy6fGewHmeLvu:vlJ1BBVx6VAROndir2
MD5:	BED1F74897D091A7DFC2B06E8A1E29A3
SHA1:	2905756DE30CBBFE9FDB7E5176AF938257CA4FDF
SHA-256:	3E89824DCD4A1D958C6972134BFC50E0C8E4A76D6B47569D14FD7CBA455C1F7F
SHA-512:	E9DD8EF350D50CEA4DA9E789B6E5102E800765FF2B12AF168B52CCD1DB04EF98AD356927549817F9762104AECC9AEEA39532D799E2B9F8066EB846BEF37CA93E
Malicious:	false
URL:	https://js-agent.newrelic.com/148.1a20d5fe-1.236.0.min.js
Preview:	/! For license information please see 148.1a20d5fe-1.236.0.min.js.LICENSE.txt /."use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[148],{8673:(t,e,n)=>{n.d(e,{M:()=>C});var s=n(1284),r=n(4351),a={"%2C":",","%3A":":","%2F":"/","%40":"@","%24":"$","%3B":";"},i=(0,s.D)(a,(function(t){return t})),o=new RegExp(i.join("\|"),"g");function c(t){return a[t]}function u(t){return null==t?"null":encodeURIComponent(t).replace(o,c)}function l(t,e){var n=0,a="";return(0,s.D)(t,(function(t,s){var i,o,c=[];if("string"==typeof s\|\|!Array.isArray(s)&&null!=s&&s.toString().length)i="&"+t+"="+u(s),n+=i.length,a+=i;else if(Array.isArray(s)&&s.length){for(n+=9,o=0;o<s.length&&(i=u((0,r.P)(s[o])),n+=i.length,!(void 0!==e&&n>=e));o++)c.push(i);a+="&"+t+"=%5B"+c.join(",")+"%5D"}})),a}function d(t,e){return e&&"string"==typeof e?"&"+t+"="+u(e):""}var h=n(4247);function f(){return""+location}var y=n(5763),g=n(4222),p=n(7894),b=n(3239),v=n(6141);function m(t,e){let n=arguments.length>2&&void

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	92
Entropy (8bit):	4.440074751043314
Encrypted:	false
SSDEEP:	3:kw3dA4jgWYHJiv3dA4jgW6QfpXD3dA4jgW6Qen:FtDjdYHJwtDjd6EpXDtDjd6h
MD5:	7C3F7E060745668041278118C0BB3D6D
SHA1:	E639F56695B3CC30D78DCE7A0084AA8299A1311A
SHA-256:	DE5341313A4DC5D982CA50AE4A491E84BC5E80B0F439D87F05FC3973C1B7E59A
SHA-512:	B12A692EF9BE5857423F2DF563B986E241F7161573B5A7F23190696D1B0A50C5DA453C7BD35641FE61695B459D0A7D76F8053A8E0E0CCBC6811F800AAB1532C6
Malicious:	false
URL:	https://www.xero.com/_next/static/1712725399/_middlewareManifest.js
Preview:	self.__MIDDLEWARE_MANIFEST=[];self.__MIDDLEWARE_MANIFEST_CB&&self.__MIDDLEWARE_MANIFEST_CB()

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	87320
Entropy (8bit):	5.27327978825666
Encrypted:	false
SSDEEP:	1536:bgw+u9Ua5vgk5ynLfD2R9P6agOK9q4tW9t:XUHuiaRh9t
MD5:	B9964AEB356BB5D1503BC9F2E041D126
SHA1:	E866168D81054F39B8CF1BDE0A08C818B812EF47
SHA-256:	2F8DA052BCBCC1D6765B9240656E87AEABB050BD4D2A496862CD75AEDAE99EA9
SHA-512:	76211C31E907F875AC7132EFE8AA7E368698292CF7D8884D82AFD1C9055527A4952BEB4BC0DFE6D3CAD37233E138784385F0B18CAE608CA624AF68D528E97002
Malicious:	false
URL:	https://www.xero.com/_next/static/chunks/main-0f9e5915b5af7510.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[179],{7228:function(e){e.exports=function(e,t){(null==t\|\|t>e.length)&&(t=e.length);for(var r=0,n=new Array(t);r<t;r++)n[r]=e[r];return n}},2858:function(e){e.exports=function(e){if(Array.isArray(e))return e}},3646:function(e,t,r){var n=r(7228);e.exports=function(e){if(Array.isArray(e))return n(e)}},1506:function(e){e.exports=function(e){if(void 0===e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}},8926:function(e){function t(e,t,r,n,a,o,i){try{var u=e[o](i),c=u.value}catch(s){return void r(s)}u.done?t(c):Promise.resolve(c).then(n,a)}e.exports=function(e){return function(){var r=this,n=arguments;return new Promise((function(a,o){var i=e.apply(r,n);function u(e){t(i,a,o,u,c,"next",e)}function c(e){t(i,a,o,u,c,"throw",e)}u(void 0)}))}}},4575:function(e){e.exports=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}},9100:function(e,t,r){var n=r(

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	4.181880697809376
Encrypted:	false
SSDEEP:	24:t4Q7zW9cohDIUVoOS4g21m/D1kQWZNvelnael2dG4aQZpmxcO:p7zAFhMMoygz/DO9gLliGspmKO
MD5:	D3BEAC69C062ABC96B9BD3DD4231F530
SHA1:	2F9406BD87B74B6ABD3472407221162C7B3F8157
SHA-256:	4A8B6268634CC24717516DC0086009E24EE6C1D7F15AF098092ADFE878CC5E61
SHA-512:	DAABAB34FE971599D7858D7B36230C3771D5524B69CD2409444037526A4758CA8B4CC619B14E15B709D1C5D869AAF7710797F62449D1D8ACDF13D52C859EFD29
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 20 14">. <path d="M19.9134 10.3193c0 .1735 0 .3469-.0866.5203 0 .1735 0 .2602-.0865.4336 0 .1735-.0866.3469-.1732.607-.0866.3469-.2597.6938-.4329.9539-.2597.3469-.5195.5203-.8658.7805-.2597.0867-.4329.1734-.6926.2601-.1732 0-.3464.0868-.4329.0868-.9524.0867-1.9048 0-2.8572 0H3.4632c-.17316 0-.34632 0-.51948-.0868-.17316 0-.25974 0-.4329-.0867-.17316 0-.4329-.0867-.60606-.1734-.4329-.1734-.77922-.3469-1.038959-.6937-.17316-.1735-.34632-.4336-.432901-.6938-.08658-.2601-.173162-.5203-.259742-.7804-.0865806-.1735-.0865792-.4336-.0865792-.6071C.0865788 10.5795 0 10.3193 0 9.97247v-.5203-.69374-.60702-2.34136-.69374-.34687-.34687-.5203c0-.17343-.00000132-.43358.0865788-.60702-.08658012-.26015 0-.43358 0-.69374.0865802-.26015.0865772-.43358.1731572-.60702.17316-.43358.346323-.86717.692644-1.214036.34632-.346868.69264-.520303 1.12554-.6937369C2.33766-8e-8 2.51082 0 2.77056 0H16.4502c.2598 0 .4329-8e-8.6927

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs&host=https%3A%2F%2Fwww.xero.com&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (630)
Category:	downloaded
Size (bytes):	10737
Entropy (8bit):	5.327237293204141
Encrypted:	false
SSDEEP:	96:DIxuZlZJFupWXpi0pGZBnXQd2q7s0ZiZmdUYe3egbwZqw8+mwoChzSBmqZTZ+Z33:kEXdMAFJdUTTE77tYHD4egFj2MFpKHc
MD5:	D86DCDBFED4C273C4742744941259902
SHA1:	98089A33D0CF2FA4B3E1BA9B7EEB9B8BA0AC82A7
SHA-256:	4B4969FA4EF3594324DA2C6D78CE8766FBBC2FD121FFF395AEDF997DB0A99A06
SHA-512:	F10E98F579D36CE13E24DBE3050C09D87F12F94578B80EA1891CA485DB48C83619D93A6B74D99639468A746CCE872AF8742CA4DBCECE7A36CFBF097B96B7EAAD
Malicious:	false
URL:	https://edge.xero.com/common/react/18.2.0/react.min.js
Preview:	/*. @license React. * react.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.(function(){'use strict';(function(c,x){"object"===typeof exports&&"undefined"!==typeof module?x(exports):"function"===typeof define&&define.amd?define(["exports"],x):(c=c\|\|self,x(c.React={}))})(this,function(c){function x(a){if(null===a\|\|"object"!==typeof a)return null;a=V&&a[V]\|\|a["@@iterator"];return"function"===typeof a?a:null}function w(a,b,e){this.props=a;this.context=b;this.refs=W;this.updater=e\|\|X}function Y(){}function K(a,b,e){this.props=a;this.context=b;this.refs=W;this.updater=e\|\|X}function Z(a,b,.e){var m,d={},c=null,h=null;if(null!=b)for(m in void 0!==b.ref&&(h=b.ref),void 0!==b.key&&(c=""+b.key),b)aa.call(b,m)&&!ba.hasOwnProperty(m)&&(d[m]=b[m]);var l=arguments.length-2;if(1===l)d.children=e;else if(1<l){for(var f=Array(l),k=0;k<l;k++)f[k

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151592740
Preview:	{}

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17673)
Category:	downloaded
Size (bytes):	18268
Entropy (8bit):	5.619856960314813
Encrypted:	false
SSDEEP:	384:Va/VuX6x1E4rZ5gIcAGn5o86/TZeIeaedo/939zg:Ukqxe4rZ5gIcAGnQ/tEaeE9C
MD5:	9FBB8606566EBF96C502666BFFFD254A
SHA1:	FEB80CB296B30432EC659D7EEDFE3C6022A450E2
SHA-256:	9644D7AB8F581B9FDE8F5C3B9B84FD370FF52F1D4E71DD60B5E590A6C7D5FD39
SHA-512:	7C9C38D0710B52EE4761EEAC4E50BB8F5E319C5AFA49253888D0F45B42DB03DE244181AF62A0BC0431D0AB963AB04A5FD2263907CE0B1188BCB1F6954622204C
Malicious:	false
URL:	https://www.google.com/js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var f=function(R,N){if(!(N=(R=e.trustedTypes,null),R)\|\|!R.createPolicy)return N;try{N=R.createPolicy("bg",{createHTML:p,createScript:p,createScriptURL:p})}catch(P){e.console&&e.console.error(P.message)}return N},p=function(R){return R},e=this\|\|self;(0,eval)(function(R,N){return(N=f())&&1===R.eval(N.createScript("1"))?function(P){return N.createScript(P)}:function(P){return""+P}}(e)(Array(7824Math.random()\|0).join("\n")+['(function(){/',.'',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var Re=function(R,N){return R[N]<<24\|R[(N\|0)+1]<<16\|R[(N\|0)+2]<<8\|R[(N\|0)+3]},d=function(R,N,p){if(438==R\|\|331==R)N.X[R]?N.X[R].concat(p):N.X[R]=N_(p,N);else{if(N.ri&&247!=R)return;466==R\|\|163==R\|\|161==R\|\|301==R\|\|172==R\|\|120==R\|\|59==R\|\|298==R\|\|344==R?N.X[R]\|\|(N.X[R]=PR(N,p,R,142)):N.X[R]=PR(N,p,R,49)}247==R&&(N.h=q(false,32,N),N.R=void 0)},eZ=function(R,N,p,e){W((e=V((p=V(R),R)),e),R,z(N,Z(p,R)))},sH=

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (598)
Category:	downloaded
Size (bytes):	947
Entropy (8bit):	5.483506372632839
Encrypted:	false
SSDEEP:	24:si2N1V4NxwZG1ASbjujzfBfH0kSbjlrhCSbjujzAQY:rN3ja3Bm5dTaoz
MD5:	C51E11843DF86143F09286A20FE99664
SHA1:	6BB9DB4F0888D12E0A684AF7FC0400359FFA8CAD
SHA-256:	90E1C4DC40981BA04F6FB2166CAE94E280232D13B7597E26DC96DC8AC65ACD87
SHA-512:	2C5EEC994BC3B4772E5CC3B63925B3A672E124D4065B5455FEB43A52497C0FB462A126EA1C3F14AE53FAFF85A980B1197EC3144E175B18E54845F55D688CEDD4
Malicious:	false
URL:	https://match.adsrvr.org/track/upb/?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/
Preview:	.<html>.<head>. <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script>.</head>.<body>. <div id="universalPixelContainer">. <script type="text/javascript">. (function(global) { . var ttdcm = new TTDCM(); . ttdcm.init( ["https://dpm.demdex.net/ibs:dpid=903&dpuuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam","https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZTA5Y2QyYWEtNzE4NS00MGE1LWJmNzQtNGZjMjliMjk0MzQ3&gdpr=0&gdpr_consent=&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347","https://tags.bluekai.com/site/5386?id=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai"] );. })(this);. </script>. </div>.</body>.</html>

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (350), with no line terminators
Category:	downloaded
Size (bytes):	350
Entropy (8bit):	5.467214262280508
Encrypted:	false
SSDEEP:	6:ZdYeLGmOYHKkCwv3Wqwy00pDX2WQLF3J+oqd6EpXjd6I:ZaiGmFMZqwyyN09FXjV
MD5:	77DDD4DA57F2FEBC999305F473A9F2B2
SHA1:	4FA36ACDE8F6DDCADBA448F2BED7E1DC906D4AA4
SHA-256:	AF7F624272CDD52A2CF5534DFC0388CE9FE0437C3342EEBFEA6AB2F0E2748097
SHA-512:	7057AF8F17D35CFD3B72A1E7C994FD4207BF7C927D37434A1D4EFD930A6530A20A72B7F0FF6D4E469A61822B72AB7B466A64983DE3A80520E6011F531B654F0F
Malicious:	false
URL:	https://www.xero.com/_next/static/1712725399/_buildManifest.js
Preview:	self.__BUILD_MANIFEST={__rewrites:{beforeFiles:[],afterFiles:[],fallback:[]},"/_error":["static/chunks/pages/_error-593dae21ba8e39dc.js"],"/[[...slug]]":["static/chunks/696-07b0fb10ce74477d.js","static/chunks/pages/[[...slug]]-fb295630692f378b.js"],sortedPages:["/_app","/_error","/[[...slug]]"]},self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151742173&i=gtm&dwt=11249&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	51
Entropy (8bit):	4.3363671951593865
Encrypted:	false
SSDEEP:	3:YWMmqehTSZ4JtZlCn:YWMm9gZ4Jt6
MD5:	427030F29C7B0DB89D0DC8062344BE31
SHA1:	9399D02456632C4510B2F34F9F99CDB999121222
SHA-256:	388D44F383FD1E564BB7E4AB095EAE911F54634DFD70C675D06A5A3E8C623CD6
SHA-512:	15B5DAD109E4282E9462E570076BDAF640C2206BC4645CE2D65D4662495748F7BF003BC3661C2ED3DF88D32BECC46B80499745F4271429AC4C6D9A24010BE979
Malicious:	false
URL:	"https://c.go-mpulse.net/api/config.json?key=DXWKX-5MGMF-RCUC3-85Q7G-8PZ8A&d=www.xero.com&t=5713839&v=1.720.0&sl=0&si=2d012957-a630-4602-8470-ddacc13d0671-sck7tm&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=534172"
Preview:	{"site_domain":"arlid:534172","rate_limited":true}.

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1775x1420, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	54806
Entropy (8bit):	7.995739185609892
Encrypted:	true
SSDEEP:	1536:Tl7vUr3b0sb16jXp2Qnmvv1cmCFiHQWMLXHUHY/U/:CDh6N9mhCFiwVLXU/
MD5:	E03D4797E7B55230D440FD2C1CACC291
SHA1:	F7E70F4AB7DE334D52DE6C1C3122DE5FEE5D02A2
SHA-256:	F7D1F5B458660A3ABD6241A824D001F831E8ED41F4D4882B10039D67613E37A9
SHA-512:	52B2FF0B17F015982E97EA5429A31AC508722A47DDE82C99266F4C09A15D470B11F59958EE8514BD173B2C4EA2B54208FC60D063ED6D68D338F5A2C8AB3CB9A9
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/audience/real-estate/audience-real-estate-accounting-software-for-real-estate.1646877652767.jpg
Preview:	RIFF....WEBPVP8 ....p........>.b.Q'...".jc...gn.t..w(.7_....\|MW....x..._......x.....`_1...{...o.G.<.........}....Vtv;...\R.s..z.w..L.y...3...C...B.....}..k...N._.l..?W....x..g.@....m.N....A......< .U.......7...W.........7......zW.... ..=..8..........q.Q..Y...!.>..M;...sZ./..:.Y..<....&qs.$...X...........4....&..i.K.g].....V.m.`Q./M.....>.7...........y.y...bPf.........~Q~...v.#/..3e_.....A..5...x.v.H. d..........=.<....?..jB`:..3$..i....Z.H......2w...........gOH.J."A._./...j......d..S+#(g\g%..\....#f![...qvd.A.B.4x`.J...<......$...$lq..L@.i.bn..(....f.N.Y.....=-.L..K....U.O.\.FOy.-.(z.^uv.+".W....dx..gE...=.....Jf?.J..R.!%X...;.. ...eV.=.9....$o...<.........i...2.j\|..Q..o.IH.=.D}g.....Q.RCY...q-II..........:.'...;1..v..K......s.E..0..%H.h.<...Q.;+.Pb.MS.-+..M&f.e.........x..:FH./.D.5.!m...$s!..!.c.a....Yb.3<..V.[{7.W.8..L.@.U..ZG9..h.mw..Ai...+o.h56.u...s..\|.)Y....nw.....D....'w.......Mk}.....:.....'..P-....P.sBc\|..9.\|.-V....nA

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 6952
Category:	downloaded
Size (bytes):	2705
Entropy (8bit):	7.918057698959248
Encrypted:	false
SSDEEP:	48:XQX5X5HqyOyC8tiTDqww8C/nPMYV+nqzNZ+C7PKSIQ8uxuZP68RZmZW2Eb3kG:uX89WAT2Z/PZPKSIQDxb8Di83kG
MD5:	639100358138073092E32069F4CC78A8
SHA1:	3D232C0EEA72AA8397AAFC8AED2A92A8DD805B4A
SHA-256:	C4342CEFDCAC64B85B860D16B96941B207B635E3EE9A1CEDC2BB04B998C9984D
SHA-512:	8C3B177488232159A7DFF5A60AD4287EBDE5C492B5292CC4DE4BC6F17CFE30E1FA3D155C8A61C046F57928B9F0DA88A2D96319A58D05505EE4BC5BC73058BDE5
Malicious:	false
URL:	https://widget.intercom.io/widget/
Preview:	...........Y.s.:..+.w'...IJK...R........i...V..c..J..$.}?..;I.e..Z..tt..Lc4.\|.Ed..{..-O^t..nIg..9.!.R%.2.3....9.A..VFj.d.....&..J..n...t..H1..<...a..AL.d..-).. r.m.d.J.....-......Uv..H..^..\|^ZkI.w.q.#....=8.5.M.D.0.LE.v..o..... .6\...x.S...==.G/..._...;...0..V3..l......6...K.b.-y2\U.6M..K...l.I."d?.+.K.Q.... aT.....#.39...........~0K.....(o.>+r.,.......u/x`t..'l..LF.(..Ls..[.4w.^.....'..'..yY7.n..f$Jr_.gY.y<..[...!.....gV...L..J.LRc.#..l.<dm.=..d..x..L.l!.....I.T.rbk$.a.../"Ey.%P..F...#.S....o.+u."...h.b...9.Z..<..n.o.e.[./......W......bS.,M.(..1m... .}.6it.5<.'...z].(..-.gpC.V..pj.NH^.Q..V...<.9ie~.Y.E......].#.]..h...7..nYl...1U....-}.r<..j.....w..2%...N.u..y.{..u}....r...ndawnz=%..n\..Wr-.>.l.b^%.q...@...(X,;.4..O=..........+^N.7!...#.u..n.&H.:.0..Zm....Zu..z].5.Z.....z.=..I...^.x...4...<..b].ne..B......?g:..4n6.9W.K.0...a.."67..k....O.......P2fXa4.T......Nj...;..G...+.......f.B..\|.........fV.f..{.d...?.T.G.)v.2.f.TK.

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696375&i=gtm&dwt=119&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	2.716326985350135
Encrypted:	false
SSDEEP:	3:tQTltaL5UJjV9GjUJjVE:6XG5UJjGjUJj2
MD5:	8E3DB10AF5A3E1CABE7AA67674E21188
SHA1:	E2314B0038DF2D49DDBE461F33A6797D4586CDE0
SHA-256:	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362
SHA-512:	A4F136016F4591E021D54F06141896581371828BF02F662A050B2A36567DFEC6068A4C758815D481E01BD7D68692329B5EE228C854AB2D85246D05B56692FB09
Malicious:	false
Preview:	[71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1596x791, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	9944
Entropy (8bit):	7.893756984394216
Encrypted:	false
SSDEEP:	192:9Jgl0KQ7SKhVb8Omn9LlH/C2cQ3DefsJ7Mcm1FxokEonsX1h:Xgl0KzKw9LJsQ3Dez51FlERlh
MD5:	A372558A45C1BBC85EC8FE5F3A192451
SHA1:	F2BD24BF5E536F310C7849E9983303B730AD071D
SHA-256:	C0B67E8D80F9492EAE10E6495BEE0A32CF9086CD284BFA75A5FA4654A752C8F7
SHA-512:	9E2AEFAD57526730019AD76FA0ACE3447683E78FA46999FE431FDAA2BB5E73027C087A193AE2A84A1762E38AB1DABC62233A74DEB972C352C941A3133D304A70
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/features/payroll/us-payroll-xero-gusto-partnership.1646877474566.jpg
Preview:	RIFF.&..WEBPVP8 .&..p....*<...>.v.U...$...a0..gn.K..9\|.jk........?.....~..?...........0.<........~]...Y...m.'.+........I?h......\|..x.......D.\..^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d...^.'....O31{ .fb.A<...y.....3....f/d......!C....5.\|..?..G.....3....f/d...^.'....O31{ .fb.A<...y}.aO.[...?.5..:..^e...c.A{ .fb.A<...y.....3....f/d...^.'....Q.}C....a#......g#s.<...y.....3....f/a...nK.....^.'....O31{ ..#.lE...z.WV.k.}.m.E.As.A{ .fb.A<....C....6..

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1464x1464, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	16222
Entropy (8bit):	7.974631286996976
Encrypted:	false
SSDEEP:	384:IQz3b608+Hj5uOMcchswnFQsOhMq5JD3+EJe5aczCAdw9YPHKa:h3Frne4qq33+EgPCb9YPqa
MD5:	112E815D75DB59CD8B174A8C76E2ADAA
SHA1:	D6B74E4FAC35DF980E24CC85798D100AA7674E5C
SHA-256:	10F8788F35F6A43BB181CF289ADE9A5FFD68164D1F1E1D7F233B0558A8E420AE
SHA-512:	4C9CB61563B159895209CCC3093176CAC41C9C5DAC2FCBF7803962301836EEEA3C431FD564CDFA61AD50A2ECD6CC0CF8CF6F9B72BF46C7AD2D6B2CC49A50073E
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/features/bank-reconciliation/BankRec_hero.1646877462797.jpg
Preview:	RIFFV?..WEBPVP8 J?...........>.t.U..?. .8s...gn...}o._..6....?.?.....?=....?.L3._. ......}>............1._.....R.f...}......./d.._..f..{G.i...{.-.I.......6RZ.?.[......a.l_b..WY...M]f^/M5u.x.4..e....e.M]f^/M5v.T../...({S.&.J.....f.....:....../i....._2.\|.32....1>.....4......R...\........I@L........^....C4...WY..2.j.X...\.3/jj..v.{S..^@f.S-..Y...M]fU./..8..{...........i.,......^."e.V..c1..`...]f^/M5u.x..<>y[ .<.Q.\|..5u.U.)......C.2.zi....B./...0...^@i.[i.`p&a...{SWY.....e..N....5u.x.4..f..^/U-....n..2../........<.Z.f.......ju\|......k.A.Y.........;.....5..1..(...........20....J.2..;.....W~...:.w.&^.../......=.../...F...\|.../j.2.._.u%.&^...e...WY....Qzi......}.s...U..x.4.....N...<V...M]f^2i4..]2.k.Y...N....]2.j.0U.+.iZ..i....e.M[U...5I.9...oP........q.?....,.3....O2.8.c....C.......2...o..=..<....I.;.gO.._..y..h;.F5...3...j..x....fe.N?=........O2.zi....m.......%.[.ht...=c.4../......+a.d.\...../Q....-...2.>'.....v...W].k....=HcM]kX.

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13094)
Category:	downloaded
Size (bytes):	13289
Entropy (8bit):	5.2902385071652605
Encrypted:	false
SSDEEP:	192:qYC8Ej/DX7Vj6zXapp2nDUyyguq5f4sPe6FU2mFnRyPsRkoXrD577tlLCPEV0KhC:qY27wrapp7yyg7W92Jgh7tFoEV/5lapB
MD5:	3D13EF41AA477D7E1EC276886B9E0EC5
SHA1:	D71D858F4341CFF90E67125A6B6AA4DB10950EA5
SHA-256:	B68EFCCAE861D874C91F6607E469061F716801E4B3849E0E2CDE0DC1B60EE9A6
SHA-512:	ECBD1C4304D8B3A61852A4A5DF52C7F455AFF5A5B5DB2C4F97A67F5BE691F079C937BF162005A36DDBC0F0E9F6DB7483F9640DF8AD390CD6426755A8FB33D79C
Malicious:	false
URL:	https://c.amazon-adsystem.com/aat/amzn.js
Preview:	/* Use of this pixel is subject to the Amazon ad specs and policies at http://www.amazon.com/b/?&node=7253015011. Version number: 6, Changeset: Adding in phone number support for setUserData */.this.amzn=this.amzn\|\|{},this.amzn.js=function(){"use strict";var e,t,n,r,o,s,a={nameLength:256,valueLength:1e3,eventNameLengthWarning:"Event name is longer than 256 characters.",parameterNameLengthWarning:"Length of parameter name exceeds 256 characters.",parameterValueLengthWarning:"Length of parameter value exceeds 1000 characters.",parameterKeyLengthWarning:"Length of parameter key exceeds 256 characters.",AIP_TOKEN_COOKIE_NAME:"aatToken",AIP_TOKEN_URL_QUERY_PARAM_NAME:"amznToken",NO_CONSENT_COOKIE_NAME:"AMZN-NoCookieConsent"};function i(){if(r)return n;r=1;const o=a,{checkCookieExists:s,getCookieValue:i}=t?e:(t=1,e={checkCookieExists:function(e){return document.cookie.split(";").some((t=>t.trim().startsWith(e)))},getCookieValue:function(e){return document.cookie.split(";").find((t=>t.trim().

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=206915&time=1714151656953&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals
Preview:	{}

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (728), with no line terminators
Category:	downloaded
Size (bytes):	728
Entropy (8bit):	5.631884042274701
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHGfVNe4U/2eVn28t0DK0wwTiUMGT2IWauqGsFsYBWhr:hMiRO9Lq4UB5L0xwI8G9PdDq
MD5:	CDB33129F101767E71344D455E0B77B4
SHA1:	CAF4C3236F7A937316AE29C78BFA16D3E16FC23E
SHA-256:	4F03D1A85C2CB5BCEB5A75E2D592F4CB798CFB676D9938A5CBA642B935E4250D
SHA-512:	953B5DAE31BD7168C8EF79A66E09394635271EFF7E8079920A921EB60B97140A6C22A1AACD1252651D96D2EED820D2296DE9129B595780839A5B17B7973F050C
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=*;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, progressive, precision 8, 1596x791, components 3
Category:	dropped
Size (bytes):	18354
Entropy (8bit):	7.126422018490339
Encrypted:	false
SSDEEP:	384:CViyWwCxup85cJhQrIqHtaMuCIs770Zmbt:RyEIJhMIStvuCI00Ap
MD5:	5AAF64C4A31E69E2273848D7CDA7C8B1
SHA1:	8649DE9054A5B04D9C7362E86BA6DED1B18A8E27
SHA-256:	4EBF788B0B05D19DEF53FC041F64B89EC9B03C17584E40582878C05FE9CCB179
SHA-512:	D1FA858BA115A739E7F44F5A3D7FA3BFE56610E0826760A0EA9FE5235D5CC8B8859E162CF7B050D57E908E96BD682D199D11DE7E54DF890B58BEAB2B778023E5
Malicious:	false
Preview:	......JFIF..........................................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F............................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F........<.."..........3......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	37832
Entropy (8bit):	7.991621084358336
Encrypted:	true
SSDEEP:	768:tx6hqBcFztw6PDwCPXdNYWfq0UTArCm8YkguX:ahqBIm6HPtbnU0edTgu
MD5:	E98022D15DA8E1616EEE200FBA6917CF
SHA1:	419D45ABA6E2BB5B7DAFB5F617501FA66FF68F55
SHA-256:	31A4F2B4A3A2B5DFB6F06BD9A93BB7E6DC1DAEFBC0B44D7E0FBB0056AF8EB194
SHA-512:	B71FBE026FCE9F9FDA9392D9C0982FC40993F556A70BFE2045027B18451CA2A4E16504BF0EEB869A31491C8850E04C940DBB45D20A5BCF2F2DBEBFB7894A3E1A
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/experimentation/2024-q4-awards-badges-for-headers/US_%20Trustpilot_G2.1710383055038.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@...................0.....................8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe.......`...`....pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe.......`...`....pixi............ipma..........................iref........auxl..........mdat.......~W.T2...`.@P...}.2.}.~@......;..Tb...Hi9W.vb..v,R...p.4..].4.e.?^..T.>.."...G..1.2..5.\.1.vz^G.'....M.-...C_.n...G.y.]B@....3Cy..S.'.n...hqZ......<KO6"....Q.$i.A...5.!A...o.c.@F.c..,........d.JX.jo...c7.V1.o..$...q..Wpl....).H.....S.fd..e+w..M.."............m....K.S..h...r..n.'?.F.&.<[...b..Xv..... &.."._l..B.....4..$..^.0k=.=' 1..'...z...j.^./...x+..$F..t.d.X.%.2f%...!qi....'`s).FT.+__.(.:"!.eo.X}.."O..$_.W..1....!..eCK.f.......I1..N9../W..Q.. U... .G..9..M.K.......CJ.....PD...,.?hw..k...,..2.....>...n.\...#.

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	368
Entropy (8bit):	7.12063513642207
Encrypted:	false
SSDEEP:	6:LZ4lNvs+K5hjnZi6PIHSs1DLli20E8hmtlEsIOzOb0kjKNLuk7UHfrFWZx14RRVh:iLZ6hjw6PoSsRnIOsKNv7AFsx19Aw76
MD5:	032A0E2CAC13DFCA4A5AB55BDA676D7D
SHA1:	BAA4EAE01777B7EF91ECBE4DF00CE211976E8FCB
SHA-256:	7BCE0A5C00B7A985D2D4DDDE3578D9D03F521DE9176D63DD6C5338428E7F7D8D
SHA-512:	069CD41E52FEA3FD380C83CCC2AE3F3873D833D0EB417886C2067FCC70BF8EB87DDB44622293A2D37DBD4875E5FFD016F7E489078F74425683ACC5C38B58C6DE
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/favicon.png
Preview:	RIFFh...WEBPVP8X..............ALPHb....O.4.$5z`O.f.D>".l>j=...$[....>`......P@a.J......!..j.a...y.......U =$9...x...\|........?....VP8 ....p...........%..t........x...X..g..37.G.7...1...1........z"je ..)'...7.f0].:y.9...i..~.\Vk..t.l..?U..1.."........}x.x.k./.0.........>..RV....9q".B..4-.Ab.......H.ICDo...i...q........)...t...F.p.....+...so.H..F..3....

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:LUQ9:LUA
MD5:	825644F747BAAB2C00E420DBBC39E4B3
SHA1:	10588307553E766AB3C7D328D948DC6754893CEF
SHA-256:	7C41B898C5DA0CFA4AA049B65EF50248BCE9A72D24BEF4C723786431921B75AA
SHA-512:	BFE6E8DF36C78CBFD17BA9270C86860EE9B051B82594FB8F34A0ADF6A14E1596D2A9DCDC7EB6857101E1502AFF6FF515A36E8BA6C80DA327BC11831624A5DAEA
Malicious:	false
Preview:	Bad Request

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7044), with no line terminators
Category:	downloaded
Size (bytes):	7044
Entropy (8bit):	5.290907214974603
Encrypted:	false
SSDEEP:	192:dOmy7u1rDgxPv0Dem1rDmZWHKOHrDD8Y4MrGKV5kej3o:dhhgYF1rDwWhHrDD8p1tG3o
MD5:	07E3C83179C7DA2E2F464A72B084AACF
SHA1:	AA7A18AA7928F3345697B21E4ED409F8A9E96648
SHA-256:	FCB70CD5B8090D9144EEEF2F1665608EE4FA67DAB1FD167F49AF074A42B9101E
SHA-512:	F44A232C19C2C933BE413248FC998E4E82A63EA9D581FE162DD517B95D0AF515AE2485CA651F0ACC86FBED015D99BDCBEF036C3B4A795E53C83F80C346798B0E
Malicious:	false
URL:	https://js-agent.newrelic.com/ajax-aggregate.998ef92b-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[898],{1199:(t,e,s)=>{s.d(e,{R:()=>a,z:()=>i});var n=[];function i(t){if(0===n.length)return!0;if(void 0===t.hostname)return!1;for(var e=0;e<n.length;e++){var s=n[e];if("*"===s.hostname)return!1;if(r(s.hostname,t.hostname)&&o(s.pathname,t.pathname))return!1}return!0}function a(t){if(n=[],t&&t.length)for(var e=0;e<t.length;e++){var s=t[e];0===s.indexOf("http://")?s=s.substring(7):0===s.indexOf("https://")&&(s=s.substring(8));var i=s.indexOf("/");i>0?n.push({hostname:s.substring(0,i),pathname:s.substring(i)}):n.push({hostname:s,pathname:""})}}function r(t,e){return!(t.length>e.length)&&e.indexOf(t)===e.length-t.length}function o(t,e){return 0===t.indexOf("/")&&(t=t.substring(1)),0===e.indexOf("/")&&(e=e.substring(1)),""===t\|\|t===e}},2573:(t,e,s)=>{s.d(e,{o:()=>d});var n=s(4247),i=s(1117),a=s(8673),r=s(8310),o=s(5763),h=s(3860);class d extends i.w{constructor(t,e,s){super(s),this.endpoint=t,this.opts=e\|\|{},this.start

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	2.716326985350135
Encrypted:	false
SSDEEP:	3:tQTltaL5UJjV9GjUJjVE:6XG5UJjGjUJj2
MD5:	8E3DB10AF5A3E1CABE7AA67674E21188
SHA1:	E2314B0038DF2D49DDBE461F33A6797D4586CDE0
SHA-256:	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362
SHA-512:	A4F136016F4591E021D54F06141896581371828BF02F662A050B2A36567DFEC6068A4C758815D481E01BD7D68692329B5EE228C854AB2D85246D05B56692FB09
Malicious:	false
Preview:	[71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2671
Entropy (8bit):	5.132766049498624
Encrypted:	false
SSDEEP:	48:Yt+PjCHcw2tGU1ap7AiG3VucK/oroup3xNBT2tVWERVOoOaV8mVOgVyEyCy7yHyB:I6oftU1apzSVurEebkta1B0vpOShUO
MD5:	0A3C6F11D41D704ED55A49CFB964ABD6
SHA1:	DA6416290DC8F56BACA37549C454901AD968CCA8
SHA-256:	EBADE59C9C8E300E7073D58BE7197DEB3511E99693AFFFE3F39D6AE4A7C6183B
SHA-512:	CD4E002223B03AA19EF8B5B6D115559069F1B0095ECB7126B4336E10468BF40AC030B474F70BE9F4114E332AD40AAA51825200501DBB43720B61A246942CA4DF
Malicious:	false
Preview:	{"status":"PAID","organisationId":"c0f47435-9703-4d0c-ac52-bdca2d164dcb","orgLegalName":"Lizzie Solutions","orgName":"Lizzie Solutions","organisationAddress":"Contact Helpdesk at: +1 (802) 277-0178 / +1 (802) 659-4471.","orgCountryCode":"US","documentType":"INVOICE","documentTitle":"INVOICE","isPdfPreview":false,"isX4XDocument":false,"isRepeatingDocument":false,"showLogo":true,"logoAlignment":"Right","contact":{"id":"2b306440-8595-4bea-9ecc-5cfcee9f8f87","name":"User","emailAddress":"Confirmation@WilliamsSolutions615.onmicrosoft.com","address":""},"documentNumber":"56576","dateString":"2024-04-26","expiryDateString":"2024-04-26","showLineItemsHeaders":true,"taxUnitName":"Tax","lineItems":[{"description":"Purchase of 0.0098469142 Bitcoin.","unitAmount":631.1800,"lineAmount":631.18,"quantity":1.0000,"taxAmount":"Tax Exempt"}],"taxLines":[{"id":"TOTAL","taxString":"Tax","lineAmount":0.0}],"deductionLines":[{"id":"DEDUCTION_PAYMENT","taxRate":0.0,"lineAmount":631.18}],"subTotal":631.18,"am

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 127 x 125, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7439
Entropy (8bit):	7.959458986017549
Encrypted:	false
SSDEEP:	96:mN9XXayL+GOzjWN9XahvfbgDF/nQbVUPAiFBMo6F0NajLFgk6Fq6xl+jEprwacsF:mNlN+rWjvpPJBMoLajL8c6b+j+sdQl
MD5:	ED5B990C1F6F92000B4C48C6592ABAC1
SHA1:	F53CDDAFD9936F28EBFB2AA148898143515F7FFE
SHA-256:	DCC988DFDCFCF2ED3A1E4A9337D042892A6576141C763252C38F53A6392D3429
SHA-512:	BC1F133A6CA971F3C7A5A7F0EF42A4DCBAB78C235ABD56A13EB0B5DF91C00841947F3C2293BDC9A7F8E5E7EFA82F9116BBC746BA850F34F451004368B7849D50
Malicious:	false
Preview:	.PNG........IHDR.......}......u......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.]....>J.4..d#y/D..a.^$.11...&.....g..5q...7........U.......TT.AaX...Y..=9.-.V...0.......vW.........!B..."...../...?>....R<.....\|....;..Ee.n..o^AE[.F.qG9......l(y.,.....>.T8P._a..M._...c..6Nz..M........a...>..y..&.....?:....F8<..`.&-J?...]v...j.T.T.u...}.r!uy.J.xks............Hk..d..o.nKg....G0..x...T..M...je(lW..-M'.M......s.].vv.... ,.yB.U[s.....f.../t+.....\|....Owi..lm.."n(.....Bs......Y...-p[..V..m.l..lz.r.49.A....i."B#p...^..nS.....M...m.o...6._..,M.l.g........6.{..+...)...].`1...=..........\L.....Er../.m~z..A.^$.>..X.tt..c...)...."..V^H..V.O.j.B.....]........YV=....+..3...e.S@#.K...u...l.`.......~.P.+..+..3:.m..j...F.....w..v..F...@7..u.H..U.{....0W.!'..$Z.-....#,/............a.3.UE.w......p.W.......os.3m...\;o[N.K......."d.F..{..0..B.3...m.w.f{b[..Ms....>..go2W.!+..tNf.A...h.#/x.K..P..\|;w..LwL.....o6W.!+....u........K.....-9.3mw.

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 209926
Category:	downloaded
Size (bytes):	53858
Entropy (8bit):	7.995253199071009
Encrypted:	true
SSDEEP:	1536:etJaNsVkKBmyWw8NkTy65gKR0dLmAOpwycIJHBo:eviEJBujkdZELmAIho
MD5:	BAECEFD335B4E7FCE271D6E3489A58A4
SHA1:	3E5D1AEAE080AC213A8ACC44475EB70908B8F0C1
SHA-256:	3E5216C5C1ECD3EF1DF3F84A9D6E32B7FC14C80B577B0BE14D426462A9B3C798
SHA-512:	18EA0B72094F41A590C749800F8E39AF221CF69AE68A1CAECE69A925D3D0B302825A99233E3053FB1A3D31E846A6FBA932359DF5A45DB049ACF584CCEEAD6080
Malicious:	false
URL:	https://js.intercomcdn.com/app~tooltips-modern.99a3541c.js
Preview:	...........b.F.(.+.6...&.7).V...3~m...DS...4.Jb(..o._v.............@..]]].2V..Eq.Nc.~....{7w#.O....b..o\?..4X\}....<<..`Z.U4...?.....f..v..:g1.....r.1..........0X-.c..d..yzk..p..O..n.d.<v.e2......lx....."x..O...y.....'..4.6..,...f.Pw...vx...[.E..n.4..y.o]..<.....Qky_...uj..F.P.V...... 4Lf@..4:...FK.^.\.s}.x...ti;.._...m{y.:]..4..h.....(.d#t.....\|~:....Uk.P;..q...k.4...2.....Q.=;vo...h.Q..f.x....d.,......4'?M....uk0.....E...gF....;.....4.7.s.s6.Y...iC....+\|..`qX....+\|......]r.Oc.......-..~\|,..[..,........M.yp......;.\|k...5.I4.Yd.....#..hO<.;`.@B.@.X.X.1..q..`.l.....@.......1..&..[9....LW.f....P..4...k$.;..S...SQ.n...@.WbL.5H.k.....W......1@.)l.o..}o.S.......+/>.._.\|.......M8.(.g..C..,q...q.\|......h.o.Af.&s.+$Z.e.H./....ad......`Q..x4..6r............p...j@.S.h.....w'.....[C\.E.Ow.\....;..M7^.Z.0.S.]5..}.....p.j.u.,.p....p5...nY.77.j..3....s.w<~..1^...%..m.....g......j/.`.....u....nC......)...9.p...M.e.m......g.5.9..3.@..u

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	24838
Entropy (8bit):	3.496915319918756
Encrypted:	false
SSDEEP:	192:xGyAUEQmLhHD+qI4nipKs3hc9ijtukd9R08c6weS:xNAUhAhjB7rsRc8jtuk7OOweS
MD5:	C169AEE3C6F710672AE66CDB0AE20879
SHA1:	CAA44FB392A6427C7E5C22437137CB771E717C53
SHA-256:	B5107D80D618E1824D266984E1673710D3A6D766E8B3997C52E1E271FB57FA49
SHA-512:	EAE8E4EF77CF5DDCA93303DAD6B1E23E6256426EE82D0E2E20F8869D4EBCDD88E3EDF3DA9755485C3B3857F286B32CCA5F60D609FC4ED5099A82714FB51CDE8D
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/favicon.ico
Preview:	......@@.... .(B..F... .... .....nB........ ......S........ .h....\..(...@......... ..........................................................................................................................+..Y......................................].......................................................................................................................................................................................@..............................................................F................................................................................................................................................................v.............................................................................#...................................................................................................................................................................................

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	99
Entropy (8bit):	4.751161476096961
Encrypted:	false
SSDEEP:	3:k0WYL12AoNojJW6QfpX/W6Qen:UYR2Af86EpXO6h
MD5:	FE21DC72429730B3443D8CB9130A2733
SHA1:	7AEB9BD09BE0DDF00622BCEC87B5CD01108576BD
SHA-256:	11BC5C5457D219BD5836C09ACF8B0B335FF4B6BE3CB66D60E9478B09967C5029
SHA-512:	0712B40B3B0726C14B2F8C6E808E70AB521A5029C985ABCF39B2A438C467127B653D6272748F1484AC1722B5FD55BBD931E1BFD6AD69C285C99E2CC98234DD19
Malicious:	false
URL:	https://www.xero.com/_next/static/1712725399/_ssgManifest.js
Preview:	self.__SSG_MANIFEST=new Set(["\u002F[[...slug]]"]);self.__SSG_MANIFEST_CB&&self.__SSG_MANIFEST_CB()

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3176), with no line terminators
Category:	downloaded
Size (bytes):	3176
Entropy (8bit):	5.210036201402933
Encrypted:	false
SSDEEP:	48:rT6fMgxOWiJDWJXLElTx4HZkTTwsTV0dO+dV445/gpfanoDhcEOdC2VM7Nbh8:SfMAbFtEwmY4V0sSV43wLdCZn8
MD5:	08F98E196C10659459A3E308C0F63E57
SHA1:	6808E34F1EF5038CEA1DE2788FC27067B30331CF
SHA-256:	0EDBB8C616E08C1E4D354255C92D032374B0192E294DFC005F268DAC8633F3CC
SHA-512:	87D8308708905C849CBDBA8304D20C5F9F26830481928A6867718DEA210C4D21180106AA24B3A7A14B2BEEF1024B76292ED42614FADBC781DA0F334D18E892DE
Malicious:	false
URL:	https://www.xero.com/_next/static/chunks/webpack-c52075616a93dd66.js
Preview:	!function(){"use strict";var e={},n={};function t(r){var o=n[r];if(void 0!==o)return o.exports;var i=n[r]={id:r,loaded:!1,exports:{}},u=!0;try{e[r].call(i.exports,i,i.exports,t),u=!1}finally{u&&delete n[r]}return i.loaded=!0,i.exports}t.m=e,function(){var e=[];t.O=function(n,r,o,i){if(!r){var u=1/0;for(l=0;l<e.length;l++){r=e[l][0],o=e[l][1],i=e[l][2];for(var a=!0,f=0;f<r.length;f++)(!1&i\|\|u>=i)&&Object.keys(t.O).every((function(e){return t.O[e](r[f])}))?r.splice(f--,1):(a=!1,i<u&&(u=i));if(a){e.splice(l--,1);var c=o();void 0!==c&&(n=c)}}return n}i=i\|\|0;for(var l=e.length;l>0&&e[l-1][2]>i;l--)e[l]=e[l-1];e[l]=[r,o,i]}}(),t.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return t.d(n,{a:n}),n},t.d=function(e,n){for(var r in n)t.o(n,r)&&!t.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:n[r]})},t.f={},t.e=function(e){return Promise.all(Object.keys(t.f).reduce((function(n,r){return t.f[r](e,n),n}),[]))},t.u=function(e){return"static/chunks/"+e+".

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1464 x 1026, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	141261
Entropy (8bit):	7.972626183612111
Encrypted:	false
SSDEEP:	3072:oabFuHG0leXuqQFivS3X4xsZtUhW5lYbYGbEETqdmE8TnyXVWmYtNd:TFqeXuqQF/3XCsWW5lZQ9ZoEmYtz
MD5:	2B291CEB90508D90A6E9E1AA1A3D3746
SHA1:	23059759C33788CFD60AAFED943BEA9D258DC974
SHA-256:	1A7EB486177B4F20E66D050C7DD13C365BB24150AEBC962359C3607CDE38D6C0
SHA-512:	3FE0F2377A35DB8AB7D701B02E9B7A9700709CC7F4A011AA2625911123E91117E043DAB1CD71CED7E32812A8D83D9487B6551EA1C8B0EF546B4320EDEDC2F9CC
Malicious:	false
Preview:	.PNG........IHDR.............Y.n.....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164050, 2019/10/01-18:03:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:dam="http://www.day.com/dam/1.0". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cq="http://www.day.com/jcr/cq/1.0". xmlns:Iptc4xmpCore="http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/". dam:Physicalheightininches="-1.0". dam:Physicalwidthininches="-1.0". dam:Fileformat="PNG". dam:Progressive="no". dam:extracted="2020-03-16T17:02:52.393+13:00". dam:Bitsperpixel="8". dam:MIMEtype="image/png". dam:Physicalwidthindpi="-1". dam:Physicalheightindpi="-1". dam:Numberofimages="1". dam:Numberoftextualcomments="0". dam:sha1="b42f48af06318f46f2ec89287c154a28fbfdac15". dam:size="139734".

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151693465&i=gtm&dwt=3&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151675451&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 37657, version 0.0
Category:	downloaded
Size (bytes):	37657
Entropy (8bit):	7.994615531012636
Encrypted:	true
SSDEEP:	768:yLwTSh39Lagf6HcjzFXP/SjGgFcj+bHnS3HWSH4fWOJ0JNYU7:wJtOMS6gFu4HazG0H7
MD5:	92DD62B0E9F8DCDF994CD07CBE7B543D
SHA1:	7A7CB6DD9200F42AC3B199D23AA6F023E2392DC8
SHA-256:	A4EDD0473C8A5002953F7FA4C7AC3FCE78DFA8F94432FD389194D8DB3211C49C
SHA-512:	3965E8F981E204262FE8A77F60ECCF8034C6257E7F9F8D63263B48CC6D3E45A52A24A8C6F4EEF869C63602E9982B0D1F6F0BCB046799EAA62198DB7B060A0F02
Malicious:	false
URL:	https://www.xero.com/fonts/national2-web-bold.woff2
Preview:	wOF2...................F...........m..3...............4.`..`..Z.R..a.....h..e.6.$........ ../......[.pq....%.-.fU..b..z.......L......(7..t.Jhw=j......Td.&...cCP.z.M,".d...R.-V[...kU# .2.fZ...E.d%.8..A%.N....[.n..W.....n....jT8@8P...Ak..6..YY...:...v.dU.9<..y...UWg.f.W.2.\|.c.6.......BGL.v.==..K.E.....D..?..D..:.K..]..A"-,.NE`n.....d..h.v..{.+.....}d+..LIeb...45.u`"...$.#W.x_......~..o1.....$.d......]r.%A....#M.T...G_.b..C.TD..TT.......~...."E.0.(...\....Q:'...`.:s..D.H".ED..Z.I+Ql....M.=W.]....c..=z..i.+Y.%[...u+{{.{..Z.....><....t.@2.4....8Pu..2R.={.4c.vOy.t...v_-.M..L...I&...v.......r)..I9 .....[:=...).hZ....A.;........K1kS....k.....DJ.h.00.7Z..r.2.S.....F....fX.\|....>gC.].\._]...Vn+.]9C.\|.N......Q.>l.~bVA!.C-B.4. q....hUH\...1...\|..@Qk6....l..3(B.F......2..4........p..5@..S.....5.p....ge.h....}9.*..I~I.........%K;...B.$]..%.S...\KW..BN8.zS@FN...~...'8Jr..j:.p....m.....Q........9.b.&0.....w+.>"..rwQ/.&E.?D....{vp.'..'.6.4i......,......e..S..!7`6y.

Chrome Cache Entry: 493

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1281), with no line terminators
Category:	downloaded
Size (bytes):	1281
Entropy (8bit):	5.803058564613862
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAjZJlX6+KVCLTLv138EgFB5vtTGJTlWtRcw1MuhtsLqo40RWUnYN:VKEciRKonR3evtTA87b1Muh6LrwUnG
MD5:	47E46980EF71564563EFEC8C4A0D741E
SHA1:	5140925C25FF11E27C6DBD0D9DC77819154D319C
SHA-256:	6491FBB639FD59BCDCF2399F616DF9AB9E7AA41C186C651DF7B7D90A101D51D3
SHA-512:	45F81F4DA05BC1A444F21CF4CCCDE211F6736792A1448F27266CB378A8B68BCDB723DCE097F8672FB81E7AA56CD144AC53826A36066E2AD6FAFC6DFB85B191BB
Malicious:	false
URL:	https://www.google.com/recaptcha/api.js?onload=onloadcallback&render=explicit
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('explicit');(cfg['onload']=cfg['onload']\|\|[]).push('onloadcallback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js';po.crossOrigin='anonymous';po

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (760), with no line terminators
Category:	downloaded
Size (bytes):	760
Entropy (8bit):	5.620025101968282
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHhoVNe4U/2eN0n2it0DK0cVx3TiUMGT2IWauqGsFsYBWht:hMiRO92oq4UBNOB0xcVxj8G9PdD8
MD5:	525CEAB6AD334990315297545CB27136
SHA1:	DDB0FEC27B83AAA3E1E69454EFCD3AD141C05611
SHA-256:	D434B3F9AC7B1B3B05783B59B0615330A8C0B0AC9F8E533ED139FC323688B655
SHA-512:	3BDCD450C677D6A917FC12FA8A34E859287025484A2B1DE4FF379AE72CC5B817E2227410D4C297D68B316600A8BB21DF65661A516283E2A28550918CDEA1AC1C
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>

Chrome Cache Entry: 495

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (688), with no line terminators
Category:	downloaded
Size (bytes):	688
Entropy (8bit):	5.612558037805841
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHBVVJtrecfCn2si0CTiUMGT2IWauqGsFsYBWht:hMiRO9eTJtrei4DA8G9PdD8
MD5:	6582327963CB29A8ECD12926E51E3E7A
SHA1:	4ACF2761C713F24EBA273A41F326BE0877094F39
SHA-256:	0E0D78B529C4EE428F2A9E79C65B2D27DE66C036F52CBF6F2DE028C9335707A0
SHA-512:	9C10536819935A01C4BFF638247A122E34F21CE6BE0CC9FE0739769C58F008CDE70E2203AEF384E8CDC18B643A8534AB47A9BE91E517876698BF60855D1A2106
Malicious:	false
URL:	https://940320.fls.doubleclick.net/activityi;dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>

Chrome Cache Entry: 496

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 497

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<html></html>

Chrome Cache Entry: 498

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12125
Entropy (8bit):	5.127508685566765
Encrypted:	false
SSDEEP:	192:fvcoO/4HZkxtBfHrBXrYDx0yGpUHH1SczAEjEEFl1/rQqH6Mq7oL1+Q0UWu:fvcoQ4HZkxbf97Yd01u1SczAgEErWAHL
MD5:	BD3D6092F3039F1AF19276217C350455
SHA1:	AB32CE1987FBB64835F76C0CFE9610837655EDFA
SHA-256:	954D820021CF74988E5F449FE05AEAD2C969EB795006473BC35DCC66D7E78E80
SHA-512:	918E6FB9CB78B251FE3F1BD5B023CD6F45048056C9CA222754107FB6DC43D1E5459DF7E6C5C9C12C6BDF7648F7AC2323364A8E8D21EF968C7D5AB7CDC7D25D6C
Malicious:	false
Preview:	{"businessUnit":{"stars":4.0,"trustScore":4.2,"displayName":"Xero","numberOfReviews":{"total":6556,"oneStar":911,"twoStars":277,"threeStars":395,"fourStars":635,"fiveStars":4338},"websiteUrl":"https://www.xero.com/"},"businessEntity":{"stars":4.0,"trustScore":4.2,"displayName":"Xero","numberOfReviews":{"total":6556,"oneStar":911,"twoStars":277,"threeStars":395,"fourStars":635,"fiveStars":4338},"websiteUrl":"https://www.xero.com/"},"reviews":[{"stars":5,"createdAt":"2023-04-13T14:50:29Z","title":"Xero is flawless.","text":"Xero is a fantastic tool that seems to have its own brain, it saves you time (and because of that most likely money).\n\nI moved from Kashflow after 6 years and the differences are amazing, with the prices being the same. It's made me want to learn more about accounting and take some of the responsibility away from my own accountant to learn more about it and do it more myself, thus learning more about my business.","reviewUrl":"https://nz.trustpilot.com/reviews/6437f

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 502

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	421
Entropy (8bit):	4.7435946287851225
Encrypted:	false
SSDEEP:	12:t4Pn4WY/ljmzTWkxR35cq9Tixc3vZNDe4A5:t4QLj8TWkx3vLXO
MD5:	2FA848925DD276C5D799963EB1A07C7D
SHA1:	D3BD8D0E4AE20653027B528AFDBF35E39268FF6B
SHA-256:	9EDAE985D631416A45E7247A93FB33B2D8362E7004EF053F2973F2826BEA0954
SHA-512:	00C8C7ED20F82C2A6A3610C40B062039FCAF9599ADEEA6DD48DD154807B5435441247BB9AC68C556EB18ABE2FD292632E5C64E629B37DE5FC46EF27387C87AF6
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/admin/icons/social-media/x-twitter-icon.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 30 30">. <path d="M17.4979 13.3155L25.3156 4H23.463L16.6749 12.0885L11.2532 4H5L13.1986 16.2313L5 26H6.85265L14.0211 17.4583L19.7468 26H26L17.4974 13.3155H17.4979ZM14.9604 16.339L14.1297 15.1211L7.52019 5.42965H10.3658L15.6997 13.2509L16.5304 14.4689L23.4639 24.6354H20.6183L14.9604 16.3395V16.339Z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 503

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=*;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 504

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151623380&i=gtm&dwt=3066&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 505

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	12125
Entropy (8bit):	5.127508685566765
Encrypted:	false
SSDEEP:	192:fvcoO/4HZkxtBfHrBXrYDx0yGpUHH1SczAEjEEFl1/rQqH6Mq7oL1+Q0UWu:fvcoQ4HZkxbf97Yd01u1SczAgEErWAHL
MD5:	BD3D6092F3039F1AF19276217C350455
SHA1:	AB32CE1987FBB64835F76C0CFE9610837655EDFA
SHA-256:	954D820021CF74988E5F449FE05AEAD2C969EB795006473BC35DCC66D7E78E80
SHA-512:	918E6FB9CB78B251FE3F1BD5B023CD6F45048056C9CA222754107FB6DC43D1E5459DF7E6C5C9C12C6BDF7648F7AC2323364A8E8D21EF968C7D5AB7CDC7D25D6C
Malicious:	false
URL:	https://widget.trustpilot.com/trustbox-data/53aa8912dec7e10d38f59f36?businessUnitId=4becd84a00006400050b6782&locale=en-NZ&reviewStars=4%2C5&reviewTagValue=product&includeReviews=true&reviewsPerPage=15
Preview:	{"businessUnit":{"stars":4.0,"trustScore":4.2,"displayName":"Xero","numberOfReviews":{"total":6556,"oneStar":911,"twoStars":277,"threeStars":395,"fourStars":635,"fiveStars":4338},"websiteUrl":"https://www.xero.com/"},"businessEntity":{"stars":4.0,"trustScore":4.2,"displayName":"Xero","numberOfReviews":{"total":6556,"oneStar":911,"twoStars":277,"threeStars":395,"fourStars":635,"fiveStars":4338},"websiteUrl":"https://www.xero.com/"},"reviews":[{"stars":5,"createdAt":"2023-04-13T14:50:29Z","title":"Xero is flawless.","text":"Xero is a fantastic tool that seems to have its own brain, it saves you time (and because of that most likely money).\n\nI moved from Kashflow after 6 years and the differences are amazing, with the prices being the same. It's made me want to learn more about accounting and take some of the responsibility away from my own accountant to learn more about it and do it more myself, thus learning more about my business.","reviewUrl":"https://nz.trustpilot.com/reviews/6437f

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	33674
Entropy (8bit):	5.005659976963834
Encrypted:	false
SSDEEP:	768:IQB919XDLzRxFlZ/CXZoxBI3gbeXm+gWzvG:IQvrDZKXZ/kp+XzvG
MD5:	BD6510FFA2C5B7C6854C7B39D3C6BFB0
SHA1:	4E977BD5B23723FFFFD4E80F4DDE661656735721
SHA-256:	66D785C2E3B9C31677F5744ECDD36B071608074AD069A8B692CEF7266ECBA880
SHA-512:	6030825FB636F0A4A04A9D4ABE13D3C8B6BE94FEE2E73F40F68777CD9AF8557507653A1F7B425D1B9D880318BAF2AD25BAB8830AC0472E1E67D2A852CB7D376E
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/accounting-software.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/accounting-software/"},{"name":"Hong Kong","code":"hk","href":"/hk/accounting-software/"},{"name":"South Africa","code":"za","href":"/za/accounting-software/"},{"name":"Malaysia","code":"my","href":"/my/accounting-software/"},{"name":"New Zealand","code":"nz","href":"/nz/accounting-software/"},{"name":"Australia","code":"au","href":"/au/accounting-software/"},{"name":"Singapore","code":"sg"

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	downloaded
Size (bytes):	225866
Entropy (8bit):	5.379271278866028
Encrypted:	false
SSDEEP:	3072:hhwvwaC82wlbixov2mtFkSY+UV5xbScYy:hhwvwaDlmxy2+kDVvmcYy
MD5:	B89693E18ED17F9B649DDAF638E17A57
SHA1:	3C51EF5B0AB1367A91F3FC50F2AC7D31C264CB88
SHA-256:	BCCE269FE4E329E6AAC07BDA59F9F10948F0FF09A492146306F16BFC24A99E35
SHA-512:	0C24B146510FE8CF5F1697041A4FB22B9AC0A4DEBBD97D028BD1AFF0439BCAA167205B4D4FEE5D54976A80D93950DEEC9112BD2584CE2A20FE5C841A7467CE22
Malicious:	false
URL:	https://script.hotjar.com/modules.25f289cf2c430c5f1dfb.js
Preview:	/! For license information please see modules.25f289cf2c430c5f1dfb.js.LICENSE.txt /.!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_recording",TAG_RECORDING:"tag_recording",HEATMAP_HELO:"heatmap_helo",RECORDING_HELO:"recording_helo",REPORT_USER_ID:"report_user_id",MUTATION:"mutation",MOUSE_CLICK:"mouse_click",INPUT_CHOICE_CHANGE:"input_choice_change",KEY_PRESS:"key_press",MOUSE_MOVE:"mouse_move",RELATIVE_MOUSE_MOVE:"relative_mouse_move",CLIPBOARD:"clipboard",PAGE_VISIBILITY:"page_visibility",SCROLL_REACH:"scroll_reach",SCROLL:"scroll",SELECT_CHANGE:"select_change",VIEWPORT_RESIZE:"viewport_resize",SCRIPT_PERFORMANCE:"script_performance",REPORT_CONTENT:"report_content",INSERTED_RULE:"inserted_rule",DELETED_RULE:"deleted_rule"})},6939:function(e,t,n){"use strict";n.d(t,{f:function(){return f},W:function(){return g}});const r=Object.freeze({LIVE:"LIVE",REVIEW_WEBAPP:"REVI

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	860
Entropy (8bit):	4.3770889600848975
Encrypted:	false
SSDEEP:	12:t4Pn4Xz8YipeOLDlOlcuhyY1pHQMOVVOam7aLfUAM++I+QX5W7e4A5:t4QDiAAicub1pwMaxm7Qy+1ZEO
MD5:	3DC20FF3068D347283B63ECBEDBC0F85
SHA1:	814B02876FD3B0614918F93DE30F077D045DA8F6
SHA-256:	0273BA68EDCAC94897E470DB55A0CBADB3752E0A86C59E3BC00D9C7AC73FB2DF
SHA-512:	4F2FF2F5179A91053CEDC9DFAC7A768E494F99D86F0827BB8D5F8957BBEF6A9CC174BF9B6230729940071975F1B0215A7AC849280F462C8BC07252BC7A36FFEB
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 17 17">. <path d="M10.19 8.5c0 .93-.76 1.69-1.69 1.69-.93 0-1.69-.76-1.69-1.69 0-.93.76-1.69 1.69-1.69.93 0 1.69.76 1.69 1.69z"/>. <path d="M10.35 4.42H6.63c-1.22 0-2.22 1-2.22 2.22v3.72c0 1.22 1 2.22 2.22 2.22h3.72c1.22 0 2.22-1 2.22-2.22V6.65c0-1.24-1-2.23-2.22-2.23zM8.5 10.93c-1.33 0-2.43-1.08-2.43-2.43S7.16 6.07 8.5 6.07s2.43 1.08 2.43 2.43c0 1.33-1.1 2.43-2.43 2.43zm2.69-4.48c-.35 0-.63-.29-.63-.63s.29-.63.63-.63.63.29.63.63-.28.63-.63.63z"/>. <path d="M12.06 0H4.94C2.22 0 0 2.22 0 4.94v7.12C0 14.78 2.22 17 4.94 17h7.12c2.73 0 4.94-2.22 4.94-4.94V4.94C17 2.22 14.78 0 12.06 0zm1.23 10.35c0 1.62-1.32 2.94-2.94 2.94H6.63c-1.62 0-2.94-1.32-2.94-2.94v-3.7c0-1.62 1.32-2.94 2.94-2.94h3.72c1.62 0 2.94 1.32 2.94 2.94v3.7z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 493458
Category:	downloaded
Size (bytes):	150799
Entropy (8bit):	7.998173297503546
Encrypted:	true
SSDEEP:	3072:vYrOhBH6u8nTTU6u5cnuHBSeVD1K9Mf12kF5+YPgei/v16zW:wrHucHUb5jBtVA9O2o5+UgH/EzW
MD5:	B27B573E6B04DAED0B4144A6E206BA93
SHA1:	026B3BC8B3F967D7096191718F9B999C06A090AF
SHA-256:	70371467412BCA4624E5589F75D4A2BB10581E6C4C9CE9F2520AC9DA5A60DECF
SHA-512:	E1787EE13F039FA01B01EF018B70FF38C5BC179EF3AEEA19E013C4DFD308D628FE9BDF91AD9B5BD47489BA1C061E68DFC9A03BA10CE28534516DB2FEFF9C4756
Malicious:	false
URL:	https://js.intercomcdn.com/vendor-modern.07772018.js
Preview:	...........i{.8.(....6'.!#Z..2...T.v.gb...**=..I,S.BR^.....9X..r......X.....8...oo....0..(e[A4.....q.....Q)c[.,..dw..,......N.}..#m..x}....g[...?s..#/...i......l...Q.q<......Z..Vs.Lgf...........c2;.#.}.h,.oY..3.{9......&A.>&.%....p.......a?.z.9.........<>.o.Xv.....O;.-...1b..p..a...V.qP...3#...^..A'.B.N..........=.^.^.X...2..HS.Y.lg'l..I......d..Zc..}..N...=vey>z.:n........ ...1.W...Ys<..0g/3.......e.$.t"k.]....+j.8..<=q..z]...U..z.0...`..d....u....g...V......^E...Q...e....9...k..8Y3].Af..&.....z...\|i..o....Z`VL.>...0..y..V+c..F...\|.E.hv..3...;2Rb........B."<......Q...&.....s..y>.K.b..Y.p.B@.8y....f.!..^..y...5.Q...V.e.x..8.._..c.JNlS.2kNY.2...-3f...-.@c..AX.a.g....a.....@......5......Y....s%M.V.5q.A.1\Nar-sl.i..c...E.(.ys.U....c..........K....K. .0wNd.3..`6.......S...p<;..1..._;]0.?@....R.l.Y....)...<.E.....I...&.C.._...h.b...&C...W.m7.n1..J~.3.....8K....Q.r... .$!2K..X.F........h.jJ.H..P#0..........\....).@..".1......C.v.N

Chrome Cache Entry: 515

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695742&i=gtm&dwt=2277&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 516

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/1023673485?random=1714151690667&cv=11&fst=1714151690667&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Preview:	<html></html>

Chrome Cache Entry: 517

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=*;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 518

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 519

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1774x1774, components 3
Category:	dropped
Size (bytes):	114894
Entropy (8bit):	7.970191630297877
Encrypted:	false
SSDEEP:	3072:/6qsaZFFbHSLjqkojm6vfofvaNkMf3Dsp+WS+XP:9bF7BvT7PDsp+WR
MD5:	39E7CBBD94E30D17EC9A5968D05EEE10
SHA1:	75730FED7F9F3BBAEA7FF7F844415E76D4A97E34
SHA-256:	90DB762CDC94F03AA2195AD328532EFF8336B29AE8CAFBDCFFA62CD85D60A22B
SHA-512:	6CAA2F80B91A7ADFF1D292DED20806B4A3711D94096BDA6965FF9CBDEF1448561AF2A5EE90243AD168FE0B4BAEA46B2252845646DC26F9CD7881682574D407C9
Malicious:	false
Preview:	......JFIF..........................................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F............................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F..........."..........5......................................................................!.e.caP+...V.......),.b.)q...%..q+..B............ab...2"..@RK...21ZIi.`...,B.".J&Pe.J... .b.e.....B...T...)Ia%..P.,YIB%$.J U.%..T...PP..T@.K..hV)j(....P.,.aH......[.U...m..........,...2...)..%.!.R.IB.....P...X.4,...(..2.cL.......cl.(...R&DJ%...,JB.!`.....cfE.K(......,E...Q.....X.X.!.!H.@.P.%.%,....RYb..D.%..RT....H(.g.S(X",.,...".YRT[,(.VP. .BX..9E.....TRP@.......D...e..d..1Zc.%..@XX......21.Fx..`..bQq.)(B..R.X...!b.". ,.,@X..RP.B(X..R..@.E..%.Aq.....B.....B..[...b.d..%.6X@T.XP....K.-...X..K+..*...R.B.a2.RR.i.....B.e!.RKL3..\h....`.....B....E.aBR.b.e.A..J. X.b2B(B.L......HP..@.J....RXe...%........J ...

Chrome Cache Entry: 520

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	4.362309726226205
Encrypted:	false
SSDEEP:	12:YWTL36JOfl1MlxKfw7I33xdfEsd6YWu7kTdgplw78fd8a/v6jUK8gPDjaL:Yi6JlcwsdcDerSLaL
MD5:	289BCB620B5FB3B5ADD262CA01820813
SHA1:	193D8ADC1B0041441AE4800ADDD2F2C0120EA3B6
SHA-256:	6D9347FDD5DDD690198DDF4EC3E04EDED6FB583E26C02A5C3E034D2C4DB67CED
SHA-512:	52EFD7C2239A4DC01954A8CBCE7C61F74CC69269FDBBAAC945E5D505383A100D7B77AAAA2487B78C73964D1C5966B5FB91DEE9E51B144B6F722DCB78A04BF519
Malicious:	false
Preview:	{"user_id": "New", "exclude_flag": false, "is_demo_training_or_test_org": false, "is_xero_staff_org": false, "spam_org_name": false, "spam_or_xero_org_flag": false, "no_sign_up_spam_email": false, "no_sign_up_education_sign_up": false, "no_sign_up_competitor_domain": false, "no_sign_up_xero_staff_sign_up": false, "no_sign_up_is_spam_name": false, "no_sign_up_user_has_been_disabled": false, "more_than_2_orgs_in_a_day": false, "spam_email": false, "education_sign_up": false, "competitor_domain": false, "xero_staff_sign_up": false, "is_spam_name": false, "is_online_invoicing_invite": false, "is_education_user_by_promo_code": false, "is_api_user": false}

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=oMnuZZCLlIev7MKDWDZRAcYQu-VVo2Uu0fXilR4p2V8&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 522

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (691), with no line terminators
Category:	downloaded
Size (bytes):	691
Entropy (8bit):	5.623570639629759
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHBYVNe4UsrecpAn2yZ3TiUMGT2IWauKfYtahr:hMiRO99q4Usre5pV8G9P9v
MD5:	502BC52160EF123110C34E08CF85D2EB
SHA1:	50A19AE7D0A5BBA2C3BCA749C82DA37249AC1A6C
SHA-256:	347C94BAFBC7994C841666DDA00945DD8FB6B9CD31F80B73EFC448CA6CC9D7A5
SHA-512:	C4D9304C81A61FCE31697269C23E7726C5F8DC462059E7706D90FB121F27E41F7030B0BD3D0CE25EFAE5090FD2586FAFCCFD812D11E24543678CD7985AD23F54
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=*;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>

Chrome Cache Entry: 523

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=*;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151629451&i=gtm&dwt=309&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151690433&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9489), with no line terminators
Category:	downloaded
Size (bytes):	9489
Entropy (8bit):	5.278787936394149
Encrypted:	false
SSDEEP:	192:+PC4wQUD8rF08hOKIQPXM88Vva4vOkECIir+2+roLy82ugisgQ:789cKIqD8VvNv9JD+roLy82jgQ
MD5:	EA0F213AC446FA34C085F244B9573B9D
SHA1:	2207589BEA5F2A40C676002CE7BF4E21EBA1888D
SHA-256:	7662BD2CB7034D86DC4BDB707AF33DD9CA3198A95D392067EE3C0C9FFAFFDF0E
SHA-512:	710C715CA96296AB3D5807D8080CED10685A10AA37AC4F042B677AE32F4C785F853511DD51AC6BED15565E485DB9D4DB11682BFF4B84A26514C61DACD64DDCBD
Malicious:	false
URL:	https://js-agent.newrelic.com/jserrors-aggregate.49e41428-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[317],{2573:(e,t,r)=>{r.d(t,{o:()=>h});var s=r(4247),n=r(1117),i=r(8673),a=r(8310),o=r(5763),c=r(3860);class h extends n.w{constructor(e,t,r){super(r),this.endpoint=e,this.opts=t\|\|{},this.started=!1,this.timeoutHandle=null,this.aborted=!1,this.harvest=new i.M(this.sharedContext),(0,a.L)(this.unload.bind(this),(0,o.Mt)(this.sharedContext.agentIdentifier,"allow_bfcache")),this.sharedContext?.ee.on(c.wO.RESET,(()=>this.runHarvest({forceNoRetry:!0})))}unload(){this.aborted\|\|(this.opts.onUnload&&this.opts.onUnload(),this.runHarvest({unload:!0}))}startTimer(e,t){this.interval=e,this.started=!0,this.scheduleHarvest(null!=t?t:this.interval)}stopTimer(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];this.aborted=e,this.started=!1,this.timeoutHandle&&clearTimeout(this.timeoutHandle)}scheduleHarvest(e,t){this.timeoutHandle\|\|(null==e&&(e=this.interval),this.timeoutHandle=setTimeout((()=>{this.timeoutHandle=null

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/1023673485?random=1714151615717&cv=11&fst=1714151615717&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Preview:	<html></html>

Chrome Cache Entry: 531

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 532

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	227671
Entropy (8bit):	5.425847817481241
Encrypted:	false
SSDEEP:	6144:WaJS6U27SSk7lnLPmaCghsgwLN9QewqLy2xO6WAR6:5JS327SSk7lKghsgwLN9Qew+y2xO6WAA
MD5:	1105FE9D55F7B1FFA83FE443D17E50A5
SHA1:	381D1FCC886D3E2913716EC2DF8234EE2B6F7C9A
SHA-256:	F3AAFCDD874FFCEB23AAE3F737353CD9D1E419908A7D4096586200D483805854
SHA-512:	7548571448C511431C8285583066CFE6646D3313F801D28FCB203CF5636BB4D4E7BB537682685F7F33F04F20E13117786D460C6F331674F9CB7E82F504848F47
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/837.d2b589355baf3fb3dfc5.chunk.js
Preview:	(self.webpackChunkmy_bills=self.webpackChunkmy_bills\|\|[]).push([[837],{82248:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default={width:11,height:7,path:"M5.5 4.2L9.625 0 11 1.4 5.5 7 0 1.4 1.375 0z"}},10966:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default={width:14,height:13,path:"M4 5.5l4-4L6.5 0 0 6.5 6.5 13 8 11.5l-4-4h10v-2z"}},44630:(e,t)=>{"use strict";t.A={width:20,height:20,path:"M10 20C15.5228 20 20 15.5228 20 10C20 4.47715 15.5228 0 10 0C4.47715 0 0 4.47715 0 10C0 15.5228 4.47715 20 10 20ZM5.8313 9.51435L4.54565 10.8L8.4026 14.6569L16.1165 6.94305L14.8308 5.65741L8.4026 12.0856L5.8313 9.51435Z"}},22664:(e,t)=>{"use strict";t.A={width:15,height:15,path:"M4 3h10c.5 0 1 .5 1 1.09v9.82c0 .545-.5 1.09-1 1.09H4c-.5 0-1-.545-1-1.09l.01-9.82C3 3.546 3.5 3 4 3zm0 11h10V4H4v10zM1 0h10c.5 0 1 .5 1 1.09V2h-1v-.91H1V11l1 .018V12H1c-.5 0-1-.5-1-.982V1.09C-.01.545.77 0 1 0z"}},81890:(e,t)=>{"use strict";t.A={width:15,height:15,path

Chrome Cache Entry: 533

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.7092327439724695
Encrypted:	false
SSDEEP:	3:YTyLV/VffcB+xNVcSLQzRE9LduUBjd4:YWLV94iDLQmpddB4
MD5:	5143820DAEB644938735D6B28C0059E7
SHA1:	22316BB57B4FA755662FD6F5FB7F749B21AC32A1
SHA-256:	740BB313221BDA5543B6FBE0BCE3DD276CC70C4FD9AA0BAE9D46B149406BECF5
SHA-512:	ABABBC2935D02EF31FA6FD14F56CF781BA8015A0DBCF8AB05CC7CFECBCABCA4B2B4E37B5B0BBE0341948DA7902613F4BC7EEA1C1FB8E9D142B3EC1D61084FBA6
Malicious:	false
Preview:	{"version_hash":"581d359d","url":"https://www.redditstatic.com/ads/581d359d/pixel.js"}

Chrome Cache Entry: 534

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (885), with no line terminators
Category:	downloaded
Size (bytes):	885
Entropy (8bit):	5.595832713258828
Encrypted:	false
SSDEEP:	24:hMiRO9uq4UBJZDJGgP0xa8G9PdD6JGPHFBx:NO+A9JGgsxDG9luJG/Fj
MD5:	B68594D501A68175CF3786B99B2FF105
SHA1:	54D51C719DE3FA6047035444D928F5E2D6CA889D
SHA-256:	CC3271E9D2315EFAE6C7053701FC2BF5F74B65B7E5C2EE3D628373B655B4E61C
SHA-512:	445E3EDBEF549F3932E96B29C104134D5E94BD9FDE2C6B58386B68F1D01D571FB9EE23861F6274040481A957A5C0549BAAB4F4158B9BB78580A77650E49BD1E0
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals"/></body></html>

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/1023673485?random=1714151696676&cv=11&fst=1714151696676&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Preview:	<html></html>

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.54178832719941
Encrypted:	false
SSDEEP:	3:YAv+e9BAJ6YSm7XJHIzRNg+wjNXWRwFH1j66qVVJMdMQUWKLb+AHfgq+WRHYn:YAme2J6YBDJHIlNgDXWqH1jwVJMyb/4l
MD5:	F447C440ABF2B8AF203938329FE494F8
SHA1:	3E071AE6400D84FB2EBE38EAEE60E1161D9F4556
SHA-256:	11BBA994684E05187E8CB291F03254CE7810FB3EABBC900299F078F2E584550F
SHA-512:	BC05CEC72D8512A1CE483156BDCD963199EBFFD224D991AABAD638D3FA075CD7C96E20B20B85C7224925B8263143772174B3BC824EA258C0B196C83E03007C9F
Malicious:	false
Preview:	{"errors":[{"code":"media_type_not_acceptable","message":"The Accept header should send a media type of application/json"}],"type":"error.list"}

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F?
Preview:	<html></html>

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	44
Entropy (8bit):	2.6968929824182477
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHht:/+t
MD5:	354857DE9229BAE15647FBC6364A4B19
SHA1:	F23E9C4FADC2E01BF323E90E5C1459BB6CF4F917
SHA-256:	5ECB58845A9AC30E4EB4B18EB0E7431BA1FB195CE035309735EFAEE67421C7A3
SHA-512:	D734513CE24E1684C2729E7D1C65764498AB06913553237F9FB0E3D252178A0CF06FF02E45592DCB996D9D757D6549ABF78667E5525E9687ECEB6645E4B45951
Malicious:	false
URL:	https://secure-gl.imrworldwide.com/cgi-bin/m?ci=tradedesk&cg=e09cd2aa-7185-40a5-bf74-4fc29b294347
Preview:	GIF89a.............!.......,...........D..;.

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151624141&i=gtm&dwt=42&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	777
Entropy (8bit):	4.459915643438751
Encrypted:	false
SSDEEP:	24:t4QCXRVeWJwuhsjofekmcmSW9glbwXf+7O:pSPph+2eBSW47O
MD5:	4A8C0BBA0F313D6DD21E55152608813A
SHA1:	31A467739D604145F8A10AE5476249801D179ED1
SHA-256:	D3AB16EE7748FFC46060A352E22BBF99B2CDF0485F3A9363099406FFB72BE411
SHA-512:	B20898A6CEF2DB7F245DEB29F1A56053DBF8DFE154911524513E30458F62B2F60060F5A3ABB108617A76D4D293B0F63E7841ADB8701AF72562EA3D5CAB496890
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 17 17">. <path d="M17 2.42857V14.4815c-.1818.9894-.7273 1.709-1.6364 2.1587-.2727.1799-.6363.1799-.9091.2699h-3.3636v-.09-6.2063-.1799h2.8182V7.55556h-2.8182V6.2963c0-.44974.2727-.62963.7273-.62963H14V2.87831h-2.5455c-.1818 0-.3636 0-.5454.08994-1.27274.35979-2.00001 1.34921-2.36364 2.51852-.18182.44974-.18182.98942-.09092 1.5291v.62963h-2.0909v2.6984c0 .09 0 .1799.18181.1799h2.00001V17H2.45455c-1-.1799-1.727278-.7196-2.181823-1.619C.0909084 15.1111.0909091 14.7513 0 14.4815V2.42857C.181818 1.43915.727272.719577 1.63636.269841 1.90909.0899471 2.27273.0899471 2.54545 0H14.7273c1 .179894 1.7272.719577 2.1818 1.61905-.0909.17989 0 .44973.0909.80952z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<html></html>

Chrome Cache Entry: 544

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A38%20GMT&n=-2d&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 545

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 546

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 547

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688247&i=gtm&dwt=1&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 548

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	163
Entropy (8bit):	5.379900791017606
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHWdi6kp7mn2GnNXC0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAWFw7m2GNS0MT6ZBAW8UZK3np
MD5:	A8B26E8098BB3A9C6BD63115F3A27508
SHA1:	47FB07B63A1078DAC1136B7D807A859F3CAA60DA
SHA-256:	5A4B1C3469C428770288489A660B26D30ED045977BF563D881480F28CFFA6A02
SHA-512:	6D46A20EFF04AE448EB0E1E5546BD9F41A111B9BB116EF76C7BB9BA81176001122D6A7824E9F399CBF8F8A3016287D8377EB74FBC3EE3E3BCE1778751228047D
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_funnel_stage=purchase_stage_user&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":["DIkJCOlBGzz8CaewRp3tjo","goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 549

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1774x1420, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	150696
Entropy (8bit):	7.99851160582748
Encrypted:	true
SSDEEP:	3072:ry10tCwiF53B35bYihK+xoyHSRqDf6saz1TShy4zQPpjs2BDn:O10liDFbhK+NZyTl14zQPpBBr
MD5:	0D12360571217A661A90CB8CF4C640E6
SHA1:	5EA2A7597633A54D31476A1FB329D841C91E219A
SHA-256:	37A4602046D92CDF62CDD14316A0DA2CB2E1D6AE3657886BABD26D1C8FBCFFD9
SHA-512:	835C14645919CC6461315C407CD226B236162B741234C60DE7073CD89D85E13F6CD6C216B9AE16A31EA33874CE718A20351DFF4CA73F9C01B60A19C964581D76
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/audience/retail/accounting-software-for-retail.1646877648814.jpg
Preview:	RIFF.L..WEBPVP8 .L...........>.\.N'.<..Q{c...cnL!B...........1......7>...p,jxL....qD.,.=...4^........~.....7.\|.....e.{p'..H....u.....p.S....b.s^o.?%.....x.?~?..........F..................l~_.../..E.k...&op.............z ...G...=...g..3......r.=.+.........o.....gLE@..N.r../..t.=8.T...So.Q.....X.......K.".%.-e.S.D.}r2......p...ZM..).v..g.=...o..q..S,.ojUv.......q..xH^....(.v...dC..#.$,.N...q......?..r..U.h.t....../.....z=.PG.C...J[?...J3!.g....[.zmt":[..?_p..X.........4.o....WzU.Nx}..c.d&R,.%.O...I....M\.Z$?....."..p.fZ..O`9Nm....&./...db..R..o.$D.~.l..s.K"/v.Q...7..d....$.r.{\..r..Y..x)W.&.~7E.`.........^.:.....y.K.\|.{l0....i.'.._?....}Z..............:.g.H..]..=...+B-.[...B.'.s....r.....A.m.Ygg...~....;;..~./..o.j\..+(....n.......[nJ...a.......h.Q"..o.....#a...3.....G16....M8Y+l..U.x9..2(Q4...K.Bu....GpWpr........Q`..}......9.sx.i..zii..A....th.......O....V.f..C.g.:.j......Z!5..2..7.R.......,./!C..&uT.!{.S.t..RL...-.0.55{.:B../...O[.4... ..*0.

Chrome Cache Entry: 550

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 551

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (50463)
Category:	downloaded
Size (bytes):	329269
Entropy (8bit):	5.6609748574670675
Encrypted:	false
SSDEEP:	3072:+B3XrsBs9560cyBxdcfxItW2HGsYonIDPEBhT1z5ryU6B:+B3XrsBs9k0cyBxdcfxItW2HZYdsz5oB
MD5:	071BDD0A45C497CE12538B5D9A8B6CA8
SHA1:	DE87DF99FABA1C33E860499BDCDAF90D7FE84A13
SHA-256:	528C9AE66C9915078CEA69D0211501F67A8AA4AB49DAC6FF20AC0930B4EEB6D3
SHA-512:	965558BCEAFF2F546F2F5DC6774F490DF345A59C4F78B0A981363104AB45312431E60C1241A04A5BD4B888F6DA62AE4FE47488D9DAC6A948C04909DDDD816AF8
Malicious:	false
URL:	https://www.xero.com/us/pricing-plans/
Preview:	<!DOCTYPE html><html lang="en"><head><meta name="viewport" content="width=device-width"/><meta charSet="utf-8"/><title>Pricing Plans \| Xero US</title><link rel="shortcut icon" href="/content/dam/xero/pilot-images/admin/icons/favicon/favicon.ico"/><link rel="icon" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="114x114" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-114x114-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="72x72" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-72x72-precomposed.png"/><link rel="apple-touch-icon-precomposed" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-precomposed.png"/><link rel="canonical

Chrome Cache Entry: 552

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151652104&i=gtm&dwt=17775&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 553

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151693461&i=gtm&dwt=163&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 554

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151608035&i=gtm&dwt=9671&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 555

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56412), with no line terminators
Category:	downloaded
Size (bytes):	56412
Entropy (8bit):	5.907540404138125
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyBblxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0BbchXwW49z2
MD5:	2C00B9F417B688224937053CD0C284A5
SHA1:	17B4C18EBC129055DD25F214C3F11E03E9DF2D82
SHA-256:	1E754B107428162C65A26D399B66DB3DAAEA09616BF8620D9DE4BC689CE48EED
SHA-512:	8DC644D4C8E6DA600C751975AC4A9E620E26179167A4021DDB1DA81B452ECF420E459DD1C23D1F2E177685B4E1006DBC5C8736024C447D0FF65F75838A785F57
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 556

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57671), with no line terminators
Category:	downloaded
Size (bytes):	57671
Entropy (8bit):	5.406436595808325
Encrypted:	false
SSDEEP:	1536:buM99dAoLYPNh7S5BTF94zGnSJpSFD2No5/g:buMdAVNiTF94zGnSJpSFDr5/g
MD5:	BBBCF811D8437A575D796A4C1E5D4FAD
SHA1:	CCE821AAE4F2B8982D9C08B308FB5306945EA68E
SHA-256:	4D15FF2317E16CCD8CA1D3248FEA7D91130E022369BB032824A84AD9967064DF
SHA-512:	6D0E3E9079DB4C175F0E8EC0279E9A89DF786D226685C0764AB20179D69E19CA269E8CC40646A97D31F95597654EC869472358BB72071011DF3410FC32E501C0
Malicious:	false
URL:	https://static.ads-twitter.com/uwt.js
Preview:	!function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=globalThis.crypto),!r&&"undefined"!=typeof window&&window.msCrypto&&(r=window.msCrypto),!r&&void 0!==n.g&&n.g.crypto&&(r=n.g.crypto),!r)try{r=n(2480)}catch(t){}var i=function(){if(r){if("function"==typeof r.getRandomValues)try{return r.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof r.randomBytes)try{return r.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")},o=Object.create\|\|function(){function t(){}return function(e){var n;return t.prototype=e,n=new t,t.prototype=null,n}}(),a={},c=a.lib={},u=c.Base={extend:function(t){var e=o(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply

Chrome Cache Entry: 557

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	26
Entropy (8bit):	2.738149333192866
Encrypted:	false
SSDEEP:	3:CUWJ/3e:4JW
MD5:	6A43099D5C8FE991A7AA7EBACA53069D
SHA1:	5BCE2F0D57305C58C7B05BFCE29EBB39A18F5570
SHA-256:	3B7B8A4B411DDF8DB9BACC2F3AABF406F8E4C0C087829B336CA331C40ADFDFF1
SHA-512:	B82C6AA1AE927ADE5FADBBAB478CFAEF26D21C1AC441F48E69CFC04CDB779B1E46D7668B4368B933213276068E52F9060228907720492A70FD9BC897191EE77C
Malicious:	false
URL:	https://segments.company-target.com/log?vendor=liveramp&user_id=Xc129704TbfKOMapYnqCvdyeW4HL9NoXRetZLpqv-QhIvVwgM
Preview:	GIF89a.......,...........;

Chrome Cache Entry: 558

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 559

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15086
Entropy (8bit):	3.6880630384772117
Encrypted:	false
SSDEEP:	96:jww8bS6XvHdjvkZl4a8RBxdxOT3xkzNAAA04aYWz50RxdJwJYpC/pJcVTJr0qsih:jww8b3XFjUSamBHgC5AAAFPRfh50qr6C
MD5:	C61C2614A52026A9833964DD82B0194C
SHA1:	44C86EA23C064983197AAE06CE7E17F729950D39
SHA-256:	A23CF2E7B89D854525BDE6330DC9301172477E78AD84BF26134A2730FE353D83
SHA-512:	247244567FA2838065B178A3C0D89421FE376BD623513705EAA518F49BF0D91EAFBF0C153B31FFB466968AC870A364D46D851A49639B82C0B128E56C3383C37A
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/admin/icons/favicon/favicon.ico
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L..O..O6.PP.Pb.Pk.Pj.P_.PK.P0.P..N......................................................................................................................................M..O0.Pq.Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Qe.Q&.P..................................................................................................................N..PL.Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q;.

Chrome Cache Entry: 560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14417
Entropy (8bit):	4.849944546066173
Encrypted:	false
SSDEEP:	192:OpFG5IOjU35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM0cv4LmYG4e:MF+IYXv96QQFhjl9FoNAsrnM0cv4LK
MD5:	2737D40F9DDD3635C29AC7BBC1140F93
SHA1:	192C44AEA4B5CA9E419B86BD61A6B799A199C808
SHA-256:	068C5925698F78899A720962D4F67CD0280D3216AF30A6FC0A2391575F6D64FF
SHA-512:	2EFB9037FBBFB91A0B5DCCDB26A88B4943AC3079583653B555A9BC71FA04BFD6E07F414BF4AAE7C4231A29E4DD88DFE831BA043A04ECC87B61D7290832763E8F
Malicious:	false
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"Established","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":true,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"1","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Set up your subscription","description":"Add your payment details from the Xero dashboard."},{"heading":"3. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["Safe and secure","Cancel with one month's notice","24/7 online support"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","promoCode":"SPRINGSAVE60","@id":"content-997853355","signupLocationInitialValue":"US","pla

Chrome Cache Entry: 561

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1670 x 1564, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	504422
Entropy (8bit):	7.9738458091197195
Encrypted:	false
SSDEEP:	12288:EowAT1Lsf5ycCX9VX5lIl7NZxgnZwpeglTQVgt6F3Z4c:EmT1gBMXY1mZw0OBtUV
MD5:	36B658E6B7A1BD060EE51FA6AE5CD391
SHA1:	A3BEA1FE5879B345AB92AA9A02612CB7AEE04864
SHA-256:	6D3FB6F9EA676EAE3718403B82DE79BCBF7FDE9E7005CBB94B59847F71E0076A
SHA-512:	E161A03A66C88C9DD1F8D6085112816FD5D998939ACC5D20413326A16DA35C2FC74474B590A1E7E889AD8DE9FE269283467D6EA6DCB5D780801A61226D5AC8DB
Malicious:	false
Preview:	.PNG........IHDR..............?......PLTE..................................mG.......w7...OU.Jo....s...diQ.....HS...Eb...?.B^.Ab.1...G...sN..5\|..E..=...%\...:...@.!U..M.'t.0q.'l....0...%f+c.'g.N3..?z.>Z.<..R...`.A..(\|.]..E..2j.4u.H..=q.~@+.D.:..F&.@f.i..N..G4.Y..6.G..<..;i...Y.3{;....b:....3..t.S..l.\|\..x..+J.....Q..]3(P..rAy<%.Z/\|..\|.WH....H.@.qL?0..zG.= .K'#....N........e..'B..sl...L/Y..hS...b.j9.W9.P3`....p..b.).]...f6R..H.~.}.H.q7#..4..[....3k0.......dB.mLT&.....[.c.mvVL`*..^0.q>.p.yC.W:.wR.M7..Gq.h7.viOG.Q.].......$.x6.Sh..{.kE.j..Q..T(E...cXO\|.#...W\EA.[?1+.r]._Ed/%L=5...y..o......WNf@4..>,...[..p`4$ +.T.fVk..)....:..%`<....~......g....yS..l.wj.VIB.m........JhL...K+Q...k}....hg...08k.....EQ.`Pp....j.g.e........M....tRNS.....&.;...xOcHy....p.......IDATx.........................................................................`v.`.Q......b....c.1...h..=...9.........................G..\|u.D...U"

Chrome Cache Entry: 562

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 563

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	699751
Entropy (8bit):	5.449062550500577
Encrypted:	false
SSDEEP:	6144:oH1nrqgFXGyEulqGj8qPRCezkEsLvtainn1gCKmn7A1FoQ+lYA0LW:W8Ij8qPRCezklLgiYmnQKQvLW
MD5:	E293A56FACB2BD87BBA5A7D4396C007D
SHA1:	334172E536B8C9E9A64EC2E09B7B2FCDA9ABF60F
SHA-256:	1843E1531452A09400E33FAF0C0E3949FB8837D6C53C334D80BB74D27493FF8A
SHA-512:	EBFAE51D99094C605C0C2D60FC5811CB0273541FE5221C8EB35264DDD95F093CD2570A045FC0119EA27A940CBC20FE8A0101D1BFC90279DA842119567D640619
Malicious:	false
URL:	https://www.xero.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-fb295630692f378b.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[120],{6237:function(e,t,n){"use strict";n.r(t),n.d(t,{__N_SSG:function(){return Nj},default:function(){return Zj}});var r=n(7757),a=n.n(r),i=n(9713),o=n.n(i),l=n(319),c=n.n(l),m=n(8926),s=n.n(m),d=n(3038),u=n.n(d),p=n(7294),f=n(6479),g=n.n(f),h=n(1482),b=n(7154),v=n.n(b),y=n(3439);function E(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function O(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?E(Object(n),!0).forEach((function(t){o()(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):E(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}var w=(0,p.createContext)({}),C=w.Provider,P=function(e,t){var n=(0,p.forwardRef)((f

Chrome Cache Entry: 564

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2905), with no line terminators
Category:	downloaded
Size (bytes):	2905
Entropy (8bit):	5.977818296420106
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt089E4rjec8pQ5zfMGc+2G9AY:wsbSUtJfxrqLWWWdV6j1JE4ric8pQ8DY
MD5:	FE21D11B157CD34A56465891DC8A01EB
SHA1:	DBD030135483432C60003B47F46CC55A0F2FC8F7
SHA-256:	8ABF8C0A9DFD705CCD5B376724E7FF1611DB22D36FB6E0D650150726304E49E7
SHA-512:	FC3821CF98BE013E2271C740818C6BCD3A68576EB343599863C1197C8ABDB9B87F3F5393BD15BB5292EA615C04E2B47F923AA77403C27615CDB502F94B9FE845
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/1023673485/?random=1714151615717&cv=11&fst=1714151615717&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 565

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688257&i=gtm&dwt=1&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 566

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 567

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41122
Entropy (8bit):	4.981399575448165
Encrypted:	false
SSDEEP:	768:fLB919XDLT7mhecUeR4yK3mBl+22+BZ6KPJkfJvG:fLvrtqyW7SsiJvG
MD5:	90E1C3D3F17E56A51122BE28E8AC41BA
SHA1:	5382C9426BA8928FE05C1C5F883E8ABF4250836F
SHA-256:	39BACB3061F4557AACFD7E95895C47E232AA8376F18FA093A3098A6ECF4BA34C
SHA-512:	49DD24DB4FEBD2281360138D613BEE19B8E6A423539849F3A6E841DFFEA71882A894D3741BC94D6088A480B0FBE9605F205DEEDFD6F999D90D8444946A359A83
Malicious:	false
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/"},{"name":"Canada","code":"ca","href":"/ca/pricing-plans/"},{"name":"United States","code":"us","href":"/us/pricing-plans/"}],"popo

Chrome Cache Entry: 568

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151699211
Preview:	{}

Chrome Cache Entry: 569

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=206915&time=1714151675425&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	{}

Chrome Cache Entry: 570

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<html></html>

Chrome Cache Entry: 571

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151674061&i=gtm&dwt=8378&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 572

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:RFREYDA:jRLA
MD5:	A454F56F4DEF70095E30E7676718042E
SHA1:	DB6A025FAFED1D1AD75A6D8BBA133D473ECC58B0
SHA-256:	3DAE93A05EDD9DCFC1864B87178A31E0BFA93E1A9B1C486C6E9CBF73CAE87862
SHA-512:	70CDF04204F3D1DFFEAF7F925EEBF04EA720735625A3BE0375E4AAAF9030C062CE6CCE84607483B282D3F9DA3482E920F17C74E226961156B1612F64814E0365
Malicious:	false
URL:	https://tracking.g2crowd.com/attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals&e=undefined
Preview:	// Tracking File

Chrome Cache Entry: 573

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151589122&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 574

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 575

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	156509
Entropy (8bit):	5.564320847038363
Encrypted:	false
SSDEEP:	1536:louiUURsj8PqgcG6Ofqfvop72UOjYPWNicaPExmEm2Oe0tNo455wjfPg0nKyNPRI:ufKGDSfFYbPEp1Oe03o4PwjMSXwMrlX8
MD5:	9A53884B84772819ACA913B374E1DA19
SHA1:	205A95AEF167A77BEE8C2C90FC531974F084D0B5
SHA-256:	3E2FE68F6861C8ECF77155708F7E227FD6C7296EBDC83599342F0E7C350B80C9
SHA-512:	10ADDCD73AF6D85000DA756CC89AEF7466CB03343B46CE72F38DE4FDF14AE031D20409DB65AE6851CB143FD714BD562AF62E739E719E747B82873DABB45D3ED3
Malicious:	false
URL:	https://www.xero.com/_next/static/chunks/696-07b0fb10ce74477d.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[696],{8551:function(e,t,d){var n=d(2858),r=d(6860),o=d(379),i=d(521);e.exports=function(e){return n(e)\|\|r(e)\|\|o(e)\|\|i()}},2705:function(e,t,d){var n=d(5639).Symbol;e.exports=n},4239:function(e,t,d){var n=d(2705),r=d(9607),o=d(2333),i=n?n.toStringTag:void 0;e.exports=function(e){return null==e?void 0===e?"[object Undefined]":"[object Null]":i&&i in Object(e)?r(e):o(e)}},7561:function(e,t,d){var n=d(7990),r=/^\s+/;e.exports=function(e){return e?e.slice(0,n(e)+1).replace(r,""):e}},1957:function(e,t,d){var n="object"==typeof d.g&&d.g&&d.g.Object===Object&&d.g;e.exports=n},9607:function(e,t,d){var n=d(2705),r=Object.prototype,o=r.hasOwnProperty,i=r.toString,$=n?n.toStringTag:void 0;e.exports=function(e){var t=o.call(e,$),d=e[$];try{e[$]=void 0;var n=!0}catch(a){}var r=i.call(e);return n&&(t?e[$]=d:delete e[$]),r}},2333:function(e){var t=Object.prototype.toString;e.exports=function(e){return t.call(e)}},5639:function(e,t,d){var n=d(195

Chrome Cache Entry: 576

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	41122
Entropy (8bit):	4.981399575448165
Encrypted:	false
SSDEEP:	768:fLB919XDLT7mhecUeR4yK3mBl+22+BZ6KPJkfJvG:fLvrtqyW7SsiJvG
MD5:	90E1C3D3F17E56A51122BE28E8AC41BA
SHA1:	5382C9426BA8928FE05C1C5F883E8ABF4250836F
SHA-256:	39BACB3061F4557AACFD7E95895C47E232AA8376F18FA093A3098A6ECF4BA34C
SHA-512:	49DD24DB4FEBD2281360138D613BEE19B8E6A423539849F3A6E841DFFEA71882A894D3741BC94D6088A480B0FBE9605F205DEEDFD6F999D90D8444946A359A83
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/pricing-plans.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/"},{"name":"Canada","code":"ca","href":"/ca/pricing-plans/"},{"name":"United States","code":"us","href":"/us/pricing-plans/"}],"popo

Chrome Cache Entry: 577

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8471), with no line terminators
Category:	downloaded
Size (bytes):	8471
Entropy (8bit):	5.262913296765828
Encrypted:	false
SSDEEP:	192:ty7T1rDK330nPOM4cbdGOyBOMJMzuTnUCD99pxZjQoiSLsJTS/dkhRPdkPKKgKra:WKO2ZkdGZxZjQo9QhRia
MD5:	A912F1CB80B2D3CF15F10D9D022B6188
SHA1:	AA6C72D278C7840AFDFC21D577338645E8056F34
SHA-256:	11B4A5F186EDF838F6E951559BEF8AA85C686A83E0A226C5A82622DA95E54307
SHA-512:	46BE37D8EAE836AE6737A66DEB211392E1A027696E74ADF3FAEEE2854ECA36F9475DC27F0535E7E8F8BB01F8161904957C10815DAED5B68582549C1F18EC2901
Malicious:	false
URL:	https://js-agent.newrelic.com/metrics-aggregate.3dc53903-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[147],{2573:(t,e,s)=>{s.d(e,{o:()=>h});var r=s(4247),o=s(1117),i=s(8673),n=s(8310),a=s(5763),c=s(3860);class h extends o.w{constructor(t,e,s){super(s),this.endpoint=t,this.opts=e\|\|{},this.started=!1,this.timeoutHandle=null,this.aborted=!1,this.harvest=new i.M(this.sharedContext),(0,n.L)(this.unload.bind(this),(0,a.Mt)(this.sharedContext.agentIdentifier,"allow_bfcache")),this.sharedContext?.ee.on(c.wO.RESET,(()=>this.runHarvest({forceNoRetry:!0})))}unload(){this.aborted\|\|(this.opts.onUnload&&this.opts.onUnload(),this.runHarvest({unload:!0}))}startTimer(t,e){this.interval=t,this.started=!0,this.scheduleHarvest(null!=e?e:this.interval)}stopTimer(){let t=arguments.length>0&&void 0!==arguments[0]&&arguments[0];this.aborted=t,this.started=!1,this.timeoutHandle&&clearTimeout(this.timeoutHandle)}scheduleHarvest(t,e){this.timeoutHandle\|\|(null==t&&(t=this.interval),this.timeoutHandle=setTimeout((()=>{this.timeoutHandle=null

Chrome Cache Entry: 578

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 579

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (36028), with no line terminators
Category:	downloaded
Size (bytes):	36028
Entropy (8bit):	5.13737983213806
Encrypted:	false
SSDEEP:	384:4BLteYfOfI1O0I9mB54uV/zCVspDWmApx+gv5qo6HPwBeloIa3eJslycEPZEgUj+:jzLkBVpJAxPGVCJNogQuWjOBF/6N
MD5:	7682536729AD9EA1A4DC8E24F4C7568A
SHA1:	52E6D0BBA139CEAF735A3A328F3A458B1450DFC9
SHA-256:	40F537631A8EA71038827C57D604891F13938A49F5208B495D587FCB48AE6B4E
SHA-512:	4D9BA1EC61B84F0417E57BA180F3692D625C4F8E86F2BE2F9B0FD1E4D416837BD18A4A8A0C2150653BF95F8A667C3A0161AEE7CD4CB920B47B3FB713F024BB3E
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/IndexRoute.5869f81b5c3105141012.css
Preview:	.my-bills-DeletedQuote .content-wrapper{height:409px;max-height:330px;padding:40px 21px;width:358px}.my-bills-DeletedQuote .subheading{font-size:15px;line-height:24px}.my-bills-DeletedQuote--copy-container{display:flex;flex-direction:column;height:100%;margin-top:19px}.my-bills-DeletedQuote--illustration{padding:0}.my-bills-Footer{width:100%}.my-bills-Footer--logo-text{color:#59606d;font-size:.8125rem}@media screen and (min-width:600px){.my-bills-Footer{padding:0 20px}}.my-bills-AcceptQuoteAction{margin-right:4px}@media screen and (min-width:600px){.my-bills-AcceptQuoteAction{margin-right:6px}}.my-bills-ActionStatus{font-weight:700;width:-moz-fit-content;width:fit-content}.my-bills-ActionStatus h1{font-size:21px}@media screen and (min-width:1000px){.my-bills-ActionStatus{margin-top:4px;padding-bottom:4px}}@media screen and (min-width:600px){.my-bills-ActionStatus{margin-right:12px}}.my-bills-ActionStatus--accepted{color:#00823c}.my-bills-ActionStatus--declined,.my-bills-ActionStatus--d

Chrome Cache Entry: 580

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3061), with no line terminators
Category:	downloaded
Size (bytes):	3061
Entropy (8bit):	5.964885494018505
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08zE40Uec8pQPJG/FzzYOh+j:wsbSUtJfxrqLWWWdV6j1HE40hc8pznhg
MD5:	5F382B7BC99BF8213B53CFE8ABBFF55E
SHA1:	BEBC86A84C0F347712799D0274BBCDC8BE4AE1E1
SHA-256:	3D0647B23B215AFF8DEC2BEEFFA885C18A639F3A4FF2A331D23DC19E6F92D552
SHA-512:	BE354935CE44B56C3D7379AE322B342317BF8536C44DB8E48F03D990058E5E0675BE6197B286D6E5926421F9C6BF061E78864B0356C18F1010B200AB4E38E191
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/1023673485/?random=1714151657883&cv=11&fst=1714151657883&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 581

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (50463)
Category:	downloaded
Size (bytes):	312527
Entropy (8bit):	5.678003575170817
Encrypted:	false
SSDEEP:	6144:PB3XrsBs9k0cyBxdcfxItH4LGKBaQ9zbzKE:J3XW2k0cyxdY/OE
MD5:	847A0BC70325A44DCB06F9108AD0D853
SHA1:	06D07168B1B4404F6F352D676E8DE75BCB14D7DC
SHA-256:	25444EB904E62522FCA89277760E7B815227DC9FE3486778A48BA0B7A1E62E46
SHA-512:	F669BD73490E2663763C311F585BA9C18E5C30CC5C5CAC4DA8A5E51B046C41F27BB5BE07CEA505E099D7BD03EBD60BF6EC4192A221E2DFBB41CA33ADC6B4669C
Malicious:	false
URL:	https://www.xero.com/us/
Preview:	<!DOCTYPE html><html lang="en"><head><meta name="viewport" content="width=device-width"/><meta charSet="utf-8"/><title>Accounting Software . Do Beautiful Business \| Xero US</title><link rel="shortcut icon" href="/content/dam/xero/pilot-images/admin/icons/favicon/favicon.ico"/><link rel="icon" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="114x114" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-114x114-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="72x72" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-72x72-precomposed.png"/><link rel="apple-touch-icon-precomposed" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-precom

Chrome Cache Entry: 582

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 583

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/1023673485?random=1714151657883&cv=11&fst=1714151657883&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Preview:	<html></html>

Chrome Cache Entry: 584

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 585

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (41360), with no line terminators
Category:	dropped
Size (bytes):	41469
Entropy (8bit):	4.937901511713219
Encrypted:	false
SSDEEP:	768:aaQB919XDLYDY83E3cLH0ozjiftdIYzan6vG:aaQvrIDY83Acz0oyftdtan6vG
MD5:	A1FFF261C856936623C6DBF210D6CC95
SHA1:	3679487CBD2E2B78AD4D44B4882B73A43D06FB4C
SHA-256:	3954AA9E9CFC5B01FB5D8FC18883B55A36E430B9B44676E8C326AF748F792204
SHA-512:	5974F142B222BE878C119D3E7BD347DA81A0F6A2EDA3F1152AF46AF6F0E076754B60D4D31A465C22A94E8FA25362DCD7071AE2D29216CDB9FD39677E077ED94E
Malicious:	false
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/legal/privacy/"},{"name":"Hong Kong","code":"hk","href":"/hk/legal/privacy/"},{"name":"South Africa","code":"za","href":"/za/legal/privacy/"},{"name":"Malaysia","code":"my","href":"/my/legal/privacy/"},{"name":"New Zealand","code":"nz","href":"/nz/legal/privacy/"},{"name":"Australia","code":"au","href":"/au/legal/privacy/"},{"name":"Singapore","code":"sg","href":"/sg/legal/privacy/"},{"name

Chrome Cache Entry: 586

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 587

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151615059&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 588

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Category:	downloaded
Size (bytes):	210623
Entropy (8bit):	5.2657612513849426
Encrypted:	false
SSDEEP:	1536:V5GwaiVU9tn4Ae6epfSsGQMG23FkRWktjkf/FFJo6fcZGY/fn5+9+vTdjBEBrBzu:3GwaL9yLJRtjkF1fcZGY/fM9qkZnS
MD5:	F1293D9665CF5713B80B2FB0FAB4A84E
SHA1:	A8C21E2D2531F842F02B75A141B2123DF17C6A9D
SHA-256:	573C961FFC4C9ED4FFD7693640512ABCD9A31736CFD49B3EAE812DFBDB3060DB
SHA-512:	4545174F1495ED729AB956F9CFC5C67FC1549A2AA9E8D0F2D3841300F989781A51337769C2B5FB3C5E5B14B9F7A185D4CECF56D15D72AAA5EA6287B05450E826
Malicious:	false
URL:	https://edge.xero.com/identity/client/1.1.13/identity.js
Preview:	!function(){"use strict";function o(t,e){var r,n=Object.keys(t);return Object.getOwnPropertySymbols&&(r=Object.getOwnPropertySymbols(t),e&&(r=r.filter(function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable})),n.push.apply(n,r)),n}function c(n){for(var e=1;e<arguments.length;e++){var i=null!=arguments[e]?arguments[e]:{};e%2?o(Object(i),!0).forEach(function(e){var t,r;t=n,r=i[e=e],e in t?Object.defineProperty(t,e,{value:r,enumerable:!0,configurable:!0,writable:!0}):t[e]=r}):Object.getOwnPropertyDescriptors?Object.defineProperties(n,Object.getOwnPropertyDescriptors(i)):o(Object(i)).forEach(function(e){Object.defineProperty(n,e,Object.getOwnPropertyDescriptor(i,e))})}return n}function M(e){return(M="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function I(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class

Chrome Cache Entry: 589

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 590

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=206915&time=1714151696133&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F
Preview:	{}

Chrome Cache Entry: 591

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695744&i=gtm&dwt=1&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 592

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 593

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 594

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696669&i=gtm&dwt=2&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 595

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 596

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695964&i=gtm&dwt=35&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 597

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 598

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (30984), with no line terminators
Category:	downloaded
Size (bytes):	30993
Entropy (8bit):	5.0011860238398675
Encrypted:	false
SSDEEP:	384:18x2ZB919XDLWT2LTzBX5C3pLH3pYEp+5y/tN0301DvG:qQB919XDL3JX5K3mED5lvG
MD5:	C84C22D7F7834797B0DEC8DAD2F0798C
SHA1:	C1A61534778B4BE259E81F0B30551284990F813E
SHA-256:	D52D7D1D16976A64176872FF784A0EA7BDC8EFB3782EB6D2A9927288FB8ED645
SHA-512:	FC4C6D11F6455DE3E961BDD3214DC19CE297ECCB8618B88C4A606D147EA36B31D5B0E7E38226AE3D010802E136C59FD130B74B03547D5CF514044AA9C50CC09A
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/"},{"name":"Hong Kong","code":"hk","href":"/hk/"},{"name":"South Africa","code":"za","href":"/za/"},{"name":"Malaysia","code":"my","href":"/my/"},{"name":"New Zealand","code":"nz","href":"/nz/"},{"name":"Australia","code":"au","href":"/au/"},{"name":"Singapore","code":"sg","href":"/sg/"},{"name":"Philippines","code":"ph","href":"/ph/"},{"name":"United Kingdom","code":"uk","href":"/uk/"},{"n

Chrome Cache Entry: 599

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	777
Entropy (8bit):	4.459915643438751
Encrypted:	false
SSDEEP:	24:t4QCXRVeWJwuhsjofekmcmSW9glbwXf+7O:pSPph+2eBSW47O
MD5:	4A8C0BBA0F313D6DD21E55152608813A
SHA1:	31A467739D604145F8A10AE5476249801D179ED1
SHA-256:	D3AB16EE7748FFC46060A352E22BBF99B2CDF0485F3A9363099406FFB72BE411
SHA-512:	B20898A6CEF2DB7F245DEB29F1A56053DBF8DFE154911524513E30458F62B2F60060F5A3ABB108617A76D4D293B0F63E7841ADB8701AF72562EA3D5CAB496890
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/admin/icons/social-media/facebook-icon.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 17 17">. <path d="M17 2.42857V14.4815c-.1818.9894-.7273 1.709-1.6364 2.1587-.2727.1799-.6363.1799-.9091.2699h-3.3636v-.09-6.2063-.1799h2.8182V7.55556h-2.8182V6.2963c0-.44974.2727-.62963.7273-.62963H14V2.87831h-2.5455c-.1818 0-.3636 0-.5454.08994-1.27274.35979-2.00001 1.34921-2.36364 2.51852-.18182.44974-.18182.98942-.09092 1.5291v.62963h-2.0909v2.6984c0 .09 0 .1799.18181.1799h2.00001V17H2.45455c-1-.1799-1.727278-.7196-2.181823-1.619C.0909084 15.1111.0909091 14.7513 0 14.4815V2.42857C.181818 1.43915.727272.719577 1.63636.269841 1.90909.0899471 2.27273.0899471 2.54545 0H14.7273c1 .179894 1.7272.719577 2.1818 1.61905-.0909.17989 0 .44973.0909.80952z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 600

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151742251&i=gtm&dwt=135&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 601

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=206915&time=1714151615032&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	{}

Chrome Cache Entry: 602

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14276), with no line terminators
Category:	downloaded
Size (bytes):	14276
Entropy (8bit):	5.2588608391759175
Encrypted:	false
SSDEEP:	384:qf0Kx2VMtxJjsCiof2vNwiL6HsQK5+J6g6ZSQbPWX0P:qf0Kx2V4xVsTof2vNwiLeK5+gg6ZSQbR
MD5:	5C2D33AFE15EF1EA0F7DFD3D77677165
SHA1:	F1D81AB13A4B3FEC6ABFE2D4994BAEF6B4D64C5A
SHA-256:	38068C6216D8CD0EBD227E767DEA7B85B17C68EE40A2B32C20CB879EA225D274
SHA-512:	FAE6AFD568572A43B54E2A579637155A1FEF7E12E3B3B2BB3048F935EC2CC7943FAD377C265F2EE71E5CB49C4C5048D1FC431766F5C3DB85C6AFB2A98242CE4B
Malicious:	false
URL:	https://js-agent.newrelic.com/860.03a8b7a5-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[860],{3860:(t,e,n)=>{n.d(e,{IK:()=>g,wO:()=>b,$s:()=>E});var r=n(4402),i=n(50),s=n(4351),o=n(2177);class a{constructor(t,e){if(!t.onEnd)throw new Error("onEnd handler is required");if(!e)throw new Error("ms duration is required");this.onEnd=t.onEnd,this.initialMs=e,this.startTimestamp=Date.now(),this.timer=this.create(this.onEnd,e)}create(t,e){return this.timer&&this.clear(),setTimeout((()=>t?t():this.onEnd()),e\|\|this.initialMs)}clear(){clearTimeout(this.timer),this.timer=null}end(){this.clear(),this.onEnd()}isValid(){return this.initialMs-(Date.now()-this.startTimestamp)>0}}var c=n(385),u=n(7056),h=n(7956),l=n(7872);class f extends a{constructor(t,e){super(t,e),this.onPause="function"==typeof t.onPause?t.onPause:()=>{},this.onRefresh="function"==typeof t.onRefresh?t.onRefresh:()=>{},this.onResume="function"==typeof t.onResume?t.onResume:()=>{},this.remainingMs=void 0,t.refreshEvents\|\|(t.refreshEvents=["click","k

Chrome Cache Entry: 603

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 604

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10158)
Category:	downloaded
Size (bytes):	10159
Entropy (8bit):	5.258869481621991
Encrypted:	false
SSDEEP:	192:LnmBNp87rbM3DM15HKoFIqfezsAVTwUZ/hR79BWbbQGVaC5hRyhGWS44qpK7YXW:LmBN+M3DMfWzf79BWbcotDRsG14X4
MD5:	D6F0435164AEFE6CF324147B77C7B6BB
SHA1:	41050F6640694E4FB214881216207B0B2A080137
SHA-256:	3A95689E90E588B166F7B3ECD334959A2D6A3DA1D73D557C8FB72FA10CF465DD
SHA-512:	74A349346D3FFC1AC88DAF1B614859233D2D3B8315913F1D7B73DCD31AD85E7513BC1509778866B812936FDBDB78E11D4A751CB0007A51071678A93EF356C70F
Malicious:	false
URL:	https://js.adsrvr.org/up_loader.1.1.0.js
Preview:	!function(){"use strict";let c=null;const l=["debug","info","warn","error"];let a=l.reduce((e,d,a)=>(e[d]=function(){var e="debug"===d?"log":d;if(c&&console&&"function"==typeof console[e]){var t=l.indexOf(c.toString().toLocaleLowerCase());if(!0===c\|\|-1<t&&t<=a){for(var n=arguments.length,i=new Array(n),o=0;o<n;o++)i[o]=arguments[o];const[a,...r]=[...i];console[e](d.toUpperCase()+" - (TTD) "+a,...r)}}},e),{});function e(e){c=e}let o=null,n=null,r=[],d=[];function t(e){var t=e[0],e=e[1];if("setIdentifier"!==t)throw"method not implemented";f(e)}function u(){i();{let n=o.detectionEventType,e=(r=m(o.triggerElements),m(o.cssSelectors)),i=[];for(var t of e)t&&t.tagName&&"INPUT"===t.tagName&&i.push(t);a.debug("triggers ",r),a.debug("validInputs ",e),d=[],r.forEach(e=>{d.push(e[n])});for(let t=0;t<r.length;t++)r[t][n]=function(){a.debug("Detect event: ",n,"on element, ",r[t]);for(var e of i){e=e.value.trim();if(function(e){var t=/((([^<>()\[\].,;:\s@"]+(\.[^<>()\[\].,;:\s@"]+)*)\|(".+"))@(([^<>(

Chrome Cache Entry: 605

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	2.716326985350135
Encrypted:	false
SSDEEP:	3:tQTltaL5UJjV9GjUJjVE:6XG5UJjGjUJj2
MD5:	8E3DB10AF5A3E1CABE7AA67674E21188
SHA1:	E2314B0038DF2D49DDBE461F33A6797D4586CDE0
SHA-256:	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362
SHA-512:	A4F136016F4591E021D54F06141896581371828BF02F662A050B2A36567DFEC6068A4C758815D481E01BD7D68692329B5EE228C854AB2D85246D05B56692FB09
Malicious:	false
Preview:	[71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Chrome Cache Entry: 606

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	32340
Entropy (8bit):	4.985866177395701
Encrypted:	false
SSDEEP:	768:tQB919XDLs9Wn5dxphxfJ+BZ6KPh94SfC2vG:tQvr89WReSsh94p2vG
MD5:	AB75BFD8899B24789E58681D7532A6F5
SHA1:	0794C6E90A3650E06BC9A8B30674501EE542D96D
SHA-256:	0C738EA950AB6F26BF788BE4E2912EB8C7A2F9D5A844571E32F7D303C0CB7443
SHA-512:	58A151B2A455EA24AFAF365B383D3DABD87EB41CDBE098AE5D8B283EF9719A549B47F7CEA93143DA85F5AE7EFF850D445B74C4966204A05BF6FA6675E28B88E1
Malicious:	false
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/established/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/established/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/established/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/established/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/established/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/established/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/established/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/established/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/established/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/established/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/established/

Chrome Cache Entry: 607

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (24077), with no line terminators
Category:	dropped
Size (bytes):	24082
Entropy (8bit):	4.970167624428361
Encrypted:	false
SSDEEP:	192:1Y9f2ZO091tHjrH5wI53JOmddRLuNiYHD28lrTlpClvMBDbpcxTVeBKWZG4X3maw:1Y9f2ZB919XDLWT28lr46GIBi0B9RvG
MD5:	DBBFB00BFAFFA1F384943EF1576CBA71
SHA1:	E30EE5989ADCEC35787906EE39390519595A17D7
SHA-256:	7B2BF2443B2C2045904F71AE050B43A29E8A22F4B17C7B790DC9E9D024909EF4
SHA-512:	3DC9311B9B642D2B9596DE5F2D76244C9FCFCCBB173059DEB769A218854D70AEB4632F00B9066CE086859F9C9C20D8114CF00109698D60146440DB24E9451B05
Malicious:	false
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/legal/offer-details/"},{"name":"Hong Kong","code":"hk","href":"/hk/legal/offer-details/"},{"name":"South Africa","code":"za","href":"/za/legal/offer-details/"},{"name":"Malaysia","code":"my","href":"/my/legal/offer-details/"},{"name":"New Zealand","code":"nz","href":"/nz/legal/offer-details/"},{"name":"Australia","code":"au","href":"/au/legal/offer-details/"},{"name":"Singapore","code":"sg"

Chrome Cache Entry: 608

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31968
Entropy (8bit):	4.9909561547420225
Encrypted:	false
SSDEEP:	384:IQxZB919XDLWT27b/b09puK7pIcp/phpjphpiQ+BZ6tkPb50NhvG:VLB919XDLnY5dxphxfJ+BZ6KPiDvG
MD5:	8282D83C25A7A80E3854CBFDACF36E79
SHA1:	0494A0AF76DC1340A49A7D2D64A97E1B3D883D30
SHA-256:	8C656E735F717A8F3DB8AD420BD4ECE53705E600F958A7611B258EC2175902ED
SHA-512:	E5D7EAFAF3D492333F2ED55E008B673E425FBF6E18D6BF7ED3B2C37FAC3AF16FB9529A4915EA35920F564447BEAA88A03F11686AD4BBE6FEDF2DC01B87A87533
Malicious:	false
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/growing/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/growing/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/growing/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/growing/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/growing/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/growing/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/growing/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/growing/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/growing/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/growing/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/growing/"},{"name":"Canada","code":"ca","href":"/ca/

Chrome Cache Entry: 609

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<html></html>

Chrome Cache Entry: 610

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=yjn0gup
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 611

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.403590365002627
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tJ8/V+/B6dS8p:6v/lhPfA/UJ63p
MD5:	EDB2AA47631C67A43709D4CCD2501E33
SHA1:	87475B448C53CF32FFE78AB121DB8BAB41D478E0
SHA-256:	6019C3C9E47DC991F8D9937DEAFBB0740C2E61E321324798CB508773B0814824
SHA-512:	65820EEAF261F01988570AFE7866D9B83901950DFBD89542009A1FAAAE520E1AF2FA08789B7E94A64B0E1A3BDC39256354EFE1D38856621851DD65E80505DBB2
Malicious:	false
URL:	https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=e09cd2aa-7185-40a5-bf74-4fc29b294347
Preview:	.PNG........IHDR.....................IDATx.c........o.......IEND.B`.

Chrome Cache Entry: 612

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 613

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (47800), with no line terminators
Category:	downloaded
Size (bytes):	47800
Entropy (8bit):	5.582573856549628
Encrypted:	false
SSDEEP:	768:Epp9zNv2L9M8R4paKaBa6aTaxaCa1em8bMkk1nOgEnrxawgSeoBg1fRWEXQVLWcR:Wp9zB2L9M8KexbE11EnrxawReAg1fU1j
MD5:	E8FDA4642D059D5AB863A2F161E4B14C
SHA1:	EB17CC87827550FF1450134D2259A1D9F588C8D1
SHA-256:	D9CC0EBD53FFA911829F887E6E3FD24ED05B7076F839CB2239F7AAEDB2B5BDCA
SHA-512:	3B4FE19C739A805DA7433F8DFEBAC61EE5FD07797CAA5C76B9B92F5FB675B16D0A370F39ACFDC55639D7A287E5D34FB4E94B64B99D164C8127D8A72A3AE7E320
Malicious:	false
URL:	https://www.dwin1.com/20923.js
Preview:	var AWIN=AWIN\|\|{};AWIN.Tracking=AWIN.Tracking\|\|{},AWIN.sProtocol="https:"==location.protocol?"https://":"http://",AWIN.iScriptCount=0,AWIN.Tracking.device9Url="https://the.sciencebehindecommerce.com/d9core",AWIN.Tracking.flags={allowNewAWCCookie:!0,allowNewGCLIDCookie:!0},AWIN.Tracking.setFlag=function(e,n){AWIN.Tracking.flags[e]=n},AWIN.Tracking.getFlag=function(e){return AWIN.Tracking.flags[e]},AWIN.tldDomains=["com","org","edu","gov","uk","net","ca","de","jp","fr","au","us","ru","ch","it","nl","se","no","es","mil","gw","ax","wf","yt","sj","mobi","eh","mh","bv","ap","cat","kp","iq","um","arpa","pm","gb","cs","td","so","aero","biz","coop","info","jobs","museum","name","pro","travel","ac","ad","ae","af","ag","ai","al","am","an","ao","aq","ar","as","at","aw","az","ba","bb","bd","be","bf","bg","bh","bi","bj","bm","bn","bo","br","bs","bt","bw","by","bz","cc","cd","cf","cg","ci","ck","cl","cm","cn","co","cr","cu","cv","cx","cy","cz","dj","dk","dm","do","dz","ec","ee","eg","er","et","eu","f

Chrome Cache Entry: 614

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<html></html>

Chrome Cache Entry: 615

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 887x710, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	24136
Entropy (8bit):	7.992783251187283
Encrypted:	true
SSDEEP:	384:+RYyUdF8mHTY9EK2ubSb+TbzJ9+Mv3OxqOjlZ99npwdkM9wwKbOHH4BKPeaXDt3:CYyDsc9EHqNTX7PAqEpwdkRbOHH40x
MD5:	AC6D62930BF74C68363D9C21B3AE461F
SHA1:	FD9ADD445CC704C25536C914E821D634696CB6F8
SHA-256:	19C35058E342E2D2DCE58666ECC81831F657187FA882BF8432D79F86CBCACEF4
SHA-512:	D3293DF232B42C00D876C98AEC2AA8931FCC8BB3B519194277DB695C87C7798E072FE85786BC684002EC1AEC993E33EA70F82EB6E00F81E1C28ECDE4898A9821
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/people/construction-brad-dodds.1646877524391.jpg
Preview:	RIFF@^..WEBPVP8 4^.......w...>.p.R..<..3.....I?y...O.>.(i.:...m.............v..U.]...3.....4.X0..x..~.z.....l._....^.~...z..d...'..G..^..=@?.za.....\.........7......._......j......3-..?p.&..O.......m.....L.b.~}U.&O.#.XP..%..z.N....\.\.+1^.....wZ......]...j).Y#...6^...Cl.!A...dh{....@..a..+...0....M..D1R...D^..]m)...5WA.-8.{.....i..+H...\..F..q.O........].....Zc.#?..?...B9...w...5....^^tWG.....D...K...Z_.n./xy.2....S.=:;.tA..Q.q......r.....cGH...J....l...%p{.s.F#....=......ZL.Hs%2'E._.v.t.e..........<..)...\|...`.9@..S.].....2`..#"..J.})......x.......3.i....F.:N...%.%tS.;..v.FN...>.j.HH:t..J(.....O..._......w.}.....&...n.5.l..a.,...\..bQ<R.8.N...}=..C%..r..GY..........Y..h.Fv.?.B...:A..........6.2..L.....1.B....U....Hh6........o..la.+x@u..)$.....c...?.L.BDcoP\|..L.....Q.s.jJ.n..........\|....k.:F..p.lO.i..Dq.xz.4.3.B....y.L"...l....?M.;..r.....i..6..[b.i.d.).~.z........p...6,`.....A5i..v..i.ya.H.'&.x.@K._..h.2.f.~.......XB5X1....

Chrome Cache Entry: 616

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7789)
Category:	downloaded
Size (bytes):	8914
Entropy (8bit):	5.3546404257509375
Encrypted:	false
SSDEEP:	192:4bnBSH54wHePBCUEqkYPBJB54f7KiT2fIOi8yLfkh:4bnBbseyYPZQrLfkh
MD5:	BFE92ACFB0373750D6837A557751CF19
SHA1:	7D034287153776D1B95F012F9ADA7E1F709272F2
SHA-256:	CB4C4C58EA1EBFB19925BE795B8826AAF36AA94AFDFC50BF29A17C53E882BA24
SHA-512:	006BA7F7858E1E2E05AAB8B7DAFA09FACD3D86C59F51610B63AFC4B8A5A5A2AF10C0E67C1DB771FA54B10CF7C872D727235D1A13BFA622848219430BAB2768C8
Malicious:	false
URL:	https://static.hotjar.com/c/hotjar-3197823.js?sv=6
Preview:	window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":3197823,"rec_value":1.0,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":true,"session_capture_console_consent":false,"anonymize_digits":true,"anonymize_emails":true,"suppress_all":false,"suppress_all_on_specific_pages":[],"suppress_text":false,"suppress_location":false,"user_attributes_enabled":true,"legal_name":"","privacy_policy_url":"","deferred_page_contents":[],"record_targeting_rules":[],"feedback_widgets":[],"heatmaps":[],"polls":[],"integrations":{"optimizely":{"tag_recordings":false},"abtasty":{"tag_recordings":false},"kissmetrics":{"send_user_id":false},"mixpanel":{"send_events":false},"unbounce":{"tag_recordings":false},"hubspot":{"enabled":false,"send_recordings":false,"send_surveys":false}},"features":["ask.popover_redesign","client_script.compression.pc","error_reporting","feedback.embeddable_widget","feedback.widgetV2","settings.billing_v2","s

Chrome Cache Entry: 617

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	2.716326985350135
Encrypted:	false
SSDEEP:	3:tQTltaL5UJjV9GjUJjVE:6XG5UJjGjUJj2
MD5:	8E3DB10AF5A3E1CABE7AA67674E21188
SHA1:	E2314B0038DF2D49DDBE461F33A6797D4586CDE0
SHA-256:	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362
SHA-512:	A4F136016F4591E021D54F06141896581371828BF02F662A050B2A36567DFEC6068A4C758815D481E01BD7D68692329B5EE228C854AB2D85246D05B56692FB09
Malicious:	false
Preview:	[71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Chrome Cache Entry: 618

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=crosswise
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 619

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 620

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	961
Entropy (8bit):	4.335852603689657
Encrypted:	false
SSDEEP:	24:t4QboLDqqHCfg/VtEAHqxJx2BSHNfieSX95rxhd7SNgO:pb0fHCg/Eoox2Et6eSFhd2OO
MD5:	899EDAE44877FBE0F00900319F56B99C
SHA1:	9B33DA58C16165D71574F5A0EFEF5E7FF1021DED
SHA-256:	C10F78A021974B7CBC3FE1211007D5B832630390AD1BD295F4B145177D2952BF
SHA-512:	20506B3E8FC320D6176CE66777128960F8DE488F287527965082B2E1481E116323D728E72C508E88B47F31761E6676EA3676CC63BBA9F4FE92F307B3CEC10128
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/admin/icons/social-media/linkedin-icon.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 19 18">. <path d="M7.16016 17.0336v-.1774V5.58804h3.81524v1.50833c.0887-.17745.2661-.3549.3549-.44362.621-.79853 1.5083-1.24216 2.4843-1.33089 1.1534-.08872 2.2181.08873 3.1054.79853.8872.62108 1.3308 1.50834 1.597 2.57304.0887.3549.0887.79853.1775 1.24216v7.18681h-3.8152v-.3549-5.6785c0-.4436-.0888-.8872-.1775-1.33086-.3549-1.33089-1.9519-1.86324-3.0166-.97598-.6211.44362-.8873 1.0647-.8873 1.86324v6.477c-1.0647-.0888-2.30686-.0888-3.63774-.0888zM1.30469 17.0343v-.2662V5.76618 5.5h3.81518v11.5343H1.30469zM1.03795 1.68578c0-.08872.08872-.26617.08872-.3549C1.39284.443627 2.28011 0 3.25609 0c.79853 0 1.50832.354902 1.86322 1.15343.62108 1.33088-.26617 2.66177-1.68577 2.75049-.35491 0-.70981 0-1.06471-.08872-.7098-.17745-1.15343-.70981-1.33088-1.41961 0-.08873-.00001-.08873-.088731-.17745.088721-.17745.088731-.3549.088731-.53236z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 621

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (728), with no line terminators
Category:	downloaded
Size (bytes):	728
Entropy (8bit):	5.631324109168063
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHaz1VNe4U/2esVQn28t0DK0bTiUMGT2IWauqGsFsYBWhr:hMiRO9nz1q4UBsUL0xn8G9PdDq
MD5:	4D33F22719F24F86964CC69E8E86C6F5
SHA1:	FA5B01D1FC3977F8B5BF81B1EC185F828DED6512
SHA-256:	7DF4CA4E55E26433383BB827168E6A2816FE50003B3137DD426C0F4377F1BC51
SHA-512:	0CEB06168B0A386A0786B6A607E7107237CB545BD1A6F44DB288FF90E8F9084CBC4F1FB499334573F81A8593C96500A3B701AFBA8288BBBD9FF6975F2DB25D60
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=*;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	21168
Entropy (8bit):	7.979713414394185
Encrypted:	false
SSDEEP:	384:rPn1HyVlvFXdZ1KeEATf123+u5ofyJX6u/KDIBK2pYqWeS9sIPAu45BVGbI/a:jn1qzXdZfEuN23+mofqyDR2p4fByV8IS
MD5:	004FE36BE02ECA52189191E1FDF1672A
SHA1:	8778E8E604E7888B999B4A78FFFCC6F2AF6B647C
SHA-256:	E0790101557AE45886BA9393F49268F773449053D6791548718799D66B3AB319
SHA-512:	F730A0413B646EB6F3F42A18C76EF4AA3F97DD09B8C7BA9F73200C61691E6A12620B83B820D67435C5B5420FA1B76D3D244B7C8E346447C8F58FA4B9A4B2B1C6
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/people/accountants-and-bookkeepers/abk_partners_hero2.1687990350369.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@...................I................H....8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe.......x...H....pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe.......x...H....pixi............ipma..........................iref........auxl........P.mdat.....f'z;..2.....$P...<j..a.W]w..7.l...eI.P..E....`..9S.WWQ9...V2..._.(.l.l#...i$m..E..:Z.cQ..Zu.....5.l=L.&.....9..LfW....Lhs...<."..I...V....M........7..1.G..eJ.0D~_..v.9.S.}$.J.....G^x.,.X.G...]......T..`c...K..x...).....6..,..Wt.@~F[....Ut.&..r..b.mW.......j...q..a._....!$..y.....m...^.i.Gr......g.?..dRj...o...9 .NE..wp.`!$.aX.`.\|W.8...0.n..! g..x..s..eZs.@*Y..Y.1<y.........h5..,.....c......>.i ..Fd.......V..X....]...w..>..........L.-g.).^.."=.0.S7tj3)...R3;E.}M..$.H.).b.vE.t.$....0.X/.....:.g...G.^[7C..P...K?..',..z..!

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151742192&i=gtm&dwt=14&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (759), with no line terminators
Category:	downloaded
Size (bytes):	759
Entropy (8bit):	5.626298344059793
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHa41Cb4XVNe4U/2elZ0n2it0DK0NTiUMGT2IWauqGsFsYB8:hMiRO9n5yq4UBKB0xV8G9PdD8
MD5:	9B5047149D54F288301E27DD660A9A80
SHA1:	8A9E49987A56124B29865A62FF31D81C64504EAC
SHA-256:	70B6E5D4405778F72718B92A269F87B2AA79E91CF200D16172AE28EEE11ED701
SHA-512:	1E6EDB8757BCBD76F78A6AA492E095A6F1F0AFFDBB88D5A82898DEEDF8F7244D495E7F995074D3029ADE90214C5EFDF6FF32CEBF511CACF1ED9D61A847C29004
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&gdpr=0&gdpr_consent=
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151589124&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmKMQoM0eXZnRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 35428
Category:	downloaded
Size (bytes):	11457
Entropy (8bit):	7.9808081927848935
Encrypted:	false
SSDEEP:	192:U0tnBBMdpkFPe/dQoJLOKLDs62Ow0yvF6csoCIBT0DVP5WpUlElZGcj:UAXMd6teCnUDs3Ow0XgyZRsUlE/Lj
MD5:	549D63DC73C5770CA6C7ACD1ABDEAAA1
SHA1:	FB9655A72C0F8CEA5DAB9693F1BF14048023AAE2
SHA-256:	53BCEF9ED6F1D7D241585FF81D0B45E4251C7962EAE0E847088C21F9FA1C24CD
SHA-512:	5A61A05E8B7474A36DCE1D0AE3AA307D720D476503498921E99617621BBACBDF942D24C7EA4E3CD6786FF1E45847A2BD50C29D6AFE841947DAE7869C06B420EC
Malicious:	false
URL:	https://js.intercomcdn.com/vendors~tooltips-modern.8e0f853f.js
Preview:	...........}ms.6.._.y:....9I..ql.IO..q.&..NJS.."U...Z..ww.. E9Io.9..3..I.c..X..u._y..4H;..j..7..Et.D.H.x..S.?_d.....\|.N....G.....GO.>vm.2..\|g-R..fI.gVo.%{.KX........g.,...1.\|8..U.?.-..:..w?.......~........._..x..&...8..s'..3..LD..x..S..q..b1,t)VE.C(Q~Z..Q.M.......5...l.8.2/.Rl..5.d..q-V.!...t...;.Ycw/.H.7zS....#{.7h..C.....y...5./...q..c9Z..3.B..F[~...i...#.^..W.R..V_......x.6`.w.q.....f+.~.V...[........d3..DN._.......dll.2.S+.Tp.H.rY.U&?.3..6._...0....o....,X...'..............i..DYt0.....VqX..jQ..#..n5.="]..Pp.\..]....E...\..s.....S.&zU.3xqI=.._^^..8G\|.5.pH..>.8...H.F@o.....i..F...`J.N..,..R....O..w..G.v...ut18.....~..^......../1.../.......z......tp.u...N...#.h...k.....q...vp...z~...y..8#............t...[......Y.,H$.Q.O..<.^l.....T.Zd..m..L.`.m..S.l.3W.....,.2q.v.\|......n".E..ye..5&G...#....7../.0..Q....Z..>...&.....y.o..p._7..YU....................l...m..~" .i..!i.3...RHGV+......g{.u-...$:i.........p..7..y..Da...U..$..0.2n.(.t..[....

Chrome Cache Entry: 632

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 39243
Category:	downloaded
Size (bytes):	11214
Entropy (8bit):	7.980660611226627
Encrypted:	false
SSDEEP:	192:8hrg3oYWnxKUgzCi0SeLJHs+R+lfgJ3TNBrSuWtlnlavH2syP1ouLksJAD:8hrgYYWnxKTQXYlfgd5gzavVymu4L
MD5:	C4D61FBB6E730A840C7F140CBB9BCD06
SHA1:	E424F981EEF8F250C3C7E0D4B60CF4E39424FC4A
SHA-256:	37D6272EA625E9FEAAD12822FF9099767915BB0DBB4019700E8EABAA95617AFF
SHA-512:	FB3D361F61356EB2DA3A7D9B871973BD081A8A100593DA0047D184817B34273DBBC878319141D7B52CA3C5C962F3F56765D15591A3186EDCED239D316DE7FE09
Malicious:	false
URL:	https://www.redditstatic.com/ads/pixel.js
Preview:	...........;ks.....N8......k]....<.l.XJ..P..+.8.....%.....w?.T..t...kzzF..d.;....P..G..N ....&...X...w;,8."H....8..B....q...u2fR,:Z..U...`zP..\|%`+.#\m...+..PU....qa..na...9..[)y%..V.ga.X.u'p...t[.kk.....a.. {K.-M"...?.A.G.z......#..su.s.............f.j[.D..1.m95.I ..P.....3!.,..X.c....^...jLl]..l.u.O..#.]..V[o.z;B..T...<x..2..8...Ml'..:......Q7.e...7Ec.I(n.x.V.......D.H$(.F9.&z....."{.XTY..5..C...y.wg...?.Yd....i{...JC...'.ZD..j....{.....b=#..q..B-...\|4....+..cg.....6.Z.;...l.v..c9...\|r..3-..S...w.\|.#.H.{)T......T.ah?..M.e.....C...S.w6...4=..&s][j..[.y.<.c.;.D.r...-...........J...v.6_._-.p.....s...>\|.N.......\|...u.\|..-.h.@....R_.A....4..i..D2._......j..O...`6u....v.M..i.Rk.}.H...v.\0.,...QI.I.. .u.....-....3;.>..a..a..*...V,..:........rW.Q..W..f.......J..p.Z`.r.VC.&..8X.LXf...4r......L.uf751......$...-"...[D.....Z...8.c/0.Y.h.f... .9.......,B.?.V.L...?U.S]@$~....y.g...DA."a`.q.-....M.<z.>.cA...........5.3..&..l.G...%]K...^..Q;.#.N.EB.tJ

Chrome Cache Entry: 633

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 634

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	163
Entropy (8bit):	5.379900791017606
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHWdi6kp7mn2GnNXC0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAWFw7m2GNS0MT6ZBAW8UZK3np
MD5:	A8B26E8098BB3A9C6BD63115F3A27508
SHA1:	47FB07B63A1078DAC1136B7D807A859F3CAA60DA
SHA-256:	5A4B1C3469C428770288489A660B26D30ED045977BF563D881480F28CFFA6A02
SHA-512:	6D46A20EFF04AE448EB0E1E5546BD9F41A111B9BB116EF76C7BB9BA81176001122D6A7824E9F399CBF8F8A3016287D8377EB74FBC3EE3E3BCE1778751228047D
Malicious:	false
Preview:	{"conversion_tracker_uids":["DIkJCOlBGzz8CaewRp3tjo","goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 635

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	421
Entropy (8bit):	4.7435946287851225
Encrypted:	false
SSDEEP:	12:t4Pn4WY/ljmzTWkxR35cq9Tixc3vZNDe4A5:t4QLj8TWkx3vLXO
MD5:	2FA848925DD276C5D799963EB1A07C7D
SHA1:	D3BD8D0E4AE20653027B528AFDBF35E39268FF6B
SHA-256:	9EDAE985D631416A45E7247A93FB33B2D8362E7004EF053F2973F2826BEA0954
SHA-512:	00C8C7ED20F82C2A6A3610C40B062039FCAF9599ADEEA6DD48DD154807B5435441247BB9AC68C556EB18ABE2FD292632E5C64E629B37DE5FC46EF27387C87AF6
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 30 30">. <path d="M17.4979 13.3155L25.3156 4H23.463L16.6749 12.0885L11.2532 4H5L13.1986 16.2313L5 26H6.85265L14.0211 17.4583L19.7468 26H26L17.4974 13.3155H17.4979ZM14.9604 16.339L14.1297 15.1211L7.52019 5.42965H10.3658L15.6997 13.2509L16.5304 14.4689L23.4639 24.6354H20.6183L14.9604 16.3395V16.339Z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151690436&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=addthis
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F?
Preview:	<html></html>

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65453)
Category:	downloaded
Size (bytes):	703335
Entropy (8bit):	5.473769441557876
Encrypted:	false
SSDEEP:	6144:GWKRqVxGkRXguntnwXcm87+0kt6cHK51zutQcEtkQpcCPC0g2yRUlZQ79QPyKWBw:GWTVh3+NW1Npkua0g2Fy/BOyO4bZs
MD5:	ABA8FC826404DB533BF4C65631596F3B
SHA1:	258161C0490B0E1283F364C1F6ABAF166363F4D3
SHA-256:	B04BB5BE3BDD535A6B73CDD01C3EBF491CA36E8081CCB36062B6D3195ACFD7A9
SHA-512:	C31AF6850FC14E84730FFB8F7378C2150F3D6A6509540D1177BECAA63B5F8FB5B06EAD76959996E2EBA469A0A7B4596485AFBDB7F70EF2F7CD47BAFFCB695121
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/main.0534d31874f9c55071ed.js
Preview:	/! For license information please see main.0534d31874f9c55071ed.js.LICENSE.txt /.(()=>{var e,t,r,n,o={14147:(e,t)=>{"use strict";function r(e){if(void 0===e)return NaN;if(null===e)return 0;if("boolean"==typeof e)return e?1:0;if("number"==typeof e)return e;if("symbol"==typeof e\|\|"bigint"==typeof e)throw new TypeError("Cannot convert symbol/bigint to number");return Number(e)}function n(e,t){return Object.is?Object.is(e,t):e===t?0!==e\|\|1/e==1/t:e!=e&&t!=t}Object.defineProperty(t,"__esModule",{value:!0}),t.msFromTime=t.OrdinaryHasInstance=t.SecFromTime=t.MinFromTime=t.HourFromTime=t.DateFromTime=t.MonthFromTime=t.InLeapYear=t.DayWithinYear=t.DaysInYear=t.YearFromTime=t.TimeFromYear=t.DayFromYear=t.WeekDay=t.Day=t.Type=t.HasOwnProperty=t.ArrayCreate=t.SameValue=t.ToObject=t.TimeClip=t.ToNumber=t.ToString=void 0,t.ToString=function(e){if("symbol"==typeof e)throw TypeError("Cannot convert a Symbol value to a string");return String(e)},t.ToNumber=r,t.TimeClip=function(e){return isFinite(e)?

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=A_Q7s4unGTnYm-YPVctf24Pt9G8KKVg5hW4EYiIohJM&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=206915&time=1714151588488&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals
Preview:	{}

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (849), with no line terminators
Category:	downloaded
Size (bytes):	849
Entropy (8bit):	5.590517110591415
Encrypted:	false
SSDEEP:	24:hMiRO9srq4UsreDDJG+LZ8G9P9HJGPHFBx:NOOFqJG+aG9FHJG/Fj
MD5:	438967BB52F9F2D5B9C7ECDEBAC36A8F
SHA1:	EF06CC5B5C6D2DD9767090D52DF97C15364DA8A3
SHA-256:	D809C3F7DBC451A1FE5219887201D73BDC6A9BBCF8B3112927ECDD15ED656256
SHA-512:	6338C62724BA11A31BAB40935794719840BCDAF9FB7CFCD84D860B3CCDC447C67BD2689ED275C6539A50E7681DC0E4B42C1D4BDD1782D84EDFC54975B93BAB2A
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals"/></body></html>

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	140120
Entropy (8bit):	5.261892554284658
Encrypted:	false
SSDEEP:	1536:Gdvp4h1iZbjR4VWsiQ9hUfse0xCOCfWf/xA9X9GAkoifpUOeHU69NGeGUQqB:GdkFfUIoO43VOe06gqB
MD5:	A19B629DA6B7DB08469C64F137DE782E
SHA1:	4C0F0F6ACF541B9F6304369C99A13DBBFBFAFDB6
SHA-256:	4A31BF6F96ABE93777E24FB23D2D54AB51492AECDCFCDA71E03739EDD27C4913
SHA-512:	876E761C57E29638A8C22D84F989C982E70365303D9C9B5C9EB31E76527210039F109D63AAD3F17334BFE15561B56E58A99B373827D6075A4FA2B3A707F4FC42
Malicious:	false
URL:	https://www.xero.com/_next/static/chunks/framework-6751a58a23a01658.js
Preview:	"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[774],{4448:function(e,n,t){var r=t(7294),l=t(3840);function a(e){for(var n="https://reactjs.org/docs/error-decoder.html?invariant="+e,t=1;t<arguments.length;t++)n+="&args[]="+encodeURIComponent(arguments[t]);return"Minified React error #"+e+"; visit "+n+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var o=new Set,u={};function i(e,n){s(e,n),s(e+"Capture",n)}function s(e,n){for(u[e]=n,e=0;e<n.length;e++)o.add(n[e])}var c=!("undefined"===typeof window\|\|"undefined"===typeof window.document\|\|"undefined"===typeof window.document.createElement),f=Object.prototype.hasOwnProperty,d=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\u

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23553)
Category:	downloaded
Size (bytes):	23678
Entropy (8bit):	5.427979461148156
Encrypted:	false
SSDEEP:	384:EqhROTku6loITotJt0++gdrDRvDe6AuXlnqkxXnATMqBpbKRUQ7LPxxGTyA4tt/:EJTku6lYt0mg6/qYATdBpbyxxkO/
MD5:	6EF104090AB8672EA053D27FAAFD4EE9
SHA1:	D7217A3C3A2F5D363396E28C8AE2B96DF1C2D3F5
SHA-256:	45A4C240A17A4D5F925EF0E125B86D882C6AD7549028D9CBF6F4F06FD1DD897D
SHA-512:	92205501B1B01F4173A16A57AAB0D847C9F574FC1A44A14D62E84AEC7EBCCAACC399EEC6823ADF082E7EBE766EBC8BA8C580E69C73CC7203D8C4C22B3660F6E2
Malicious:	false
URL:	https://secure.quantserve.com/quant.js
Preview:	/* Copyright (c) 2008-2023, Quantcast Corp. https://www.quantcast.com/legal/license /.!function(){"use strict";var e="qcSes";function t(){var e=r();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(function(t){var n=(e+16Math.random())%16\|0;return e=Math.floor(e/16),("x"===t?n:3&n\|8).toString(16)}))}var n=function(){try{if(!window.sessionStorage)return t()}catch(e){return t()}var n;try{if(n=window.sessionStorage.getItem(e))return n}catch(e){return t()}n=t();try{window.sessionStorage.setItem(e,n)}catch(e){}return n}();function r(){return(new Date).getTime()}function o(){return new Date}function i(e){var t=new Date(2e3,e,1,0,0,0,0),n=t.toUTCString(),r=new Date(n.substring(0,n.lastIndexOf(" ")-1));return t.getTime()-r.getTime()}function a(){return Math.round(2147483647*Math.random())}/qcdbgc=1$/.test(window.location.toString());function c(e,t){"undefined"!=typeof console&&console.log.apply(console,[e+" "+o().toString()].concat([].slice.call(t)))}var u=function(){for(var e=[]

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4179)
Category:	downloaded
Size (bytes):	211236
Entropy (8bit):	5.540625653140943
Encrypted:	false
SSDEEP:	3072:TQQaf5qZ3fhO++Yc/8iG1LceF2/ea8LR9Wk9ARCzOQjSTnXDL9btIM0+jw:MQX5N+lYLceF+scTnXP9RIM38
MD5:	0FB90BAF42B22B8D9B7F3745F186243D
SHA1:	38588419F26B88A409A3F176FB49B3BFF3618791
SHA-256:	27513D68983800ADD83B96E464693310BD9A7B44623B738400028A557C040957
SHA-512:	F2A7600E9ACB6D10B7A77D4545ACA888666E4BB1701299BAF8ADD08B14C0737DAC44C19B6801DC3AB3A85CFF1466950B7B807859557CE2595D0CFEB025C7B785
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=DC-9401320
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_1p_data_v2","priority":1,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"","vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":4},{"function":"__r

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696133&i=gtm&dwt=154&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (631)
Category:	downloaded
Size (bytes):	517649
Entropy (8bit):	5.713376874006511
Encrypted:	false
SSDEEP:	6144:m1K1Z7NMxjW6eJoWvAlUjWwuMSYCVvLk8DSWd1Ps8Jz38iZc:m6eWTAujfuPY0JGgkt
MD5:	E2E79D6B927169D9E0E57E3BAECC0993
SHA1:	1299473950B2999BA0B7F39BD5E4A60EAFD1819D
SHA-256:	231336ED913A5EBD4445B85486E053CAF2B81CAB91318241375F3F7A245B6C6B
SHA-512:	D6A2ED7B19E54D1447EE9BBC684AF7101B48086945A938A5F9B6AE74ACE30B9A98CA83D3183814DD3CC40F251AB6433DC7F8B425F313EA9557B83E1C2E035DFF
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that contro

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:RFREYDA:jRLA
MD5:	A454F56F4DEF70095E30E7676718042E
SHA1:	DB6A025FAFED1D1AD75A6D8BBA133D473ECC58B0
SHA-256:	3DAE93A05EDD9DCFC1864B87178A31E0BFA93E1A9B1C486C6E9CBF73CAE87862
SHA-512:	70CDF04204F3D1DFFEAF7F925EEBF04EA720735625A3BE0375E4AAAF9030C062CE6CCE84607483B282D3F9DA3482E920F17C74E226961156B1612F64814E0365
Malicious:	false
URL:	https://tracking.g2crowd.com/attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/pricing-plans/&e=undefined
Preview:	// Tracking File

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (723), with no line terminators
Category:	downloaded
Size (bytes):	723
Entropy (8bit):	5.629730166057118
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHrJy7nrVNe4UsreYIMMn2sS1TiUMGT2IWauKfYtaht:hMiRO9t7nrq4UsreYIbDU8G9P9p
MD5:	EFB00AEF2B5E59859A081DF0B2CA8514
SHA1:	7E9D29F4D74609CE85CACE244C1F9CBF81DED2DE
SHA-256:	FE59B590706296C5CD99A49EB14920162B85C89A499FCCF074FCA34EF2D9AECA
SHA-512:	6321A13E4C3C696A51992B71426EEF75317A22118951F950F40B9A975D26D14443F5EE466B6F1979B4A8750660CC6E0BCD72CB3372708FCDB30E6613B2432D61
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65282), with no line terminators
Category:	downloaded
Size (bytes):	77066
Entropy (8bit):	4.899158540911283
Encrypted:	false
SSDEEP:	768:uVQB919XDLYeujvaZSD/hwBqN9VbJg49RzJ+mt7gtBlM2FgtcVXZPanjvvG:uVQvrIeujCZSD5PJ+mt7GOqVJijvvG
MD5:	CA7470FDBCAB948A8AEEF40A9B5C0114
SHA1:	D606ED84A2079F31ECDCDD6106AF1919E9978D06
SHA-256:	3692D352533EDFE3CFCE7EA38DAE62C06103563DD5C029EAC256E18275AFD30D
SHA-512:	DE25B8C903ACC7A94C8873F52643A56FA36A2F6B89574D805AF543A727A8F57DDE22FABECB1E6B3E4A5419D42A2108743B8B3A099180A486E7E5E9CB9CF07338
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/legal/terms.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/legal/terms/"},{"name":"Hong Kong","code":"hk","href":"/hk/legal/terms/"},{"name":"South Africa","code":"za","href":"/za/legal/terms/"},{"name":"Malaysia","code":"my","href":"/my/legal/terms/"},{"name":"New Zealand","code":"nz","href":"/nz/legal/terms/"},{"name":"Australia","code":"au","href":"/au/legal/terms/"},{"name":"Singapore","code":"sg","href":"/sg/legal/terms/"},{"name":"Philippines

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	32486
Entropy (8bit):	4.987386893886161
Encrypted:	false
SSDEEP:	384:wqxZB919XDLWT2Fc7/bx9puK7pIcp/phpjphpiQ+BZ6tkPJhRGF0NnvG:/LB919XDLJq5dxphxfJ+BZ6KPTRFdvG
MD5:	77FC11FA1986B4677BF3AA32C67427F3
SHA1:	1DD7FD9C65774EEC65B3C15795CE28B320852F43
SHA-256:	DE09B8EA91D88B0A1BD894BE0CFBF8E54028FEA3381761613CE257B583C191B1
SHA-512:	A0286714518425A520BC428D1F53A94987FFE2CCA031D96F71915ED912E16B4C7A8847EA0021082F12E9789B5F252519DFED79E72D41634C72AADA93F5A1BEA4
Malicious:	false
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/early/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/early/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/early/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/early/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/early/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/early/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/early/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/early/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/early/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/early/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/early/"},{"name":"Canada","code":"ca","href":"/ca/pricing-plans/early/"}

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151690955&i=gtm&dwt=2515&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (65103)
Category:	downloaded
Size (bytes):	209939
Entropy (8bit):	5.366006952026174
Encrypted:	false
SSDEEP:	3072:1P6RsHIwj0PdUgdbs8kvdYkODdlm9AZoZXs+eSc:1msHIxHMvd8dtZoZDc
MD5:	FA4C76A7FDE62B18054CF7EB8E946012
SHA1:	B20150066A879D2B78DD3D4908F4ACD148EE66F8
SHA-256:	09EBD7F407439990AAC227E70DA23E1A819E8E30282928E324370805F480BEC4
SHA-512:	D72F5D078675C7ADBF6BFC1980712542A10668AEC9163137A2EC70A5E117F8FFDD0F06A6C4C6636E35C04F2754F33D40C65C59D452AFAA8EA4A382F24F200ABD
Malicious:	false
URL:	https://s.go-mpulse.net/boomerang/DXWKX-5MGMF-RCUC3-85Q7G-8PZ8A
Preview:	/. Copyright (c) 2011, Yahoo! Inc. All rights reserved.. * Copyright (c) 2011-2012, Log-Normal, Inc. All rights reserved.. * Copyright (c) 2012-2017, SOASTA, Inc. All rights reserved.. * Copyright (c) 2017, Akamai Technologies, Inc. All rights reserved.. * Copyrights licensed under the BSD License. See the accompanying LICENSE.txt file for terms.. /./ Boomerang Version: 1.720.0 b17966bb92f8ac2ddcda4ac1d9c0aaea6d2eda7b */..BOOMR_start=(new Date).getTime();function BOOMR_check_doc_domain(e){if(window){if(!e){if(window.parent===window\|\|!document.getElementById("boomr-if-as"))return;if(window.BOOMR&&BOOMR.boomerang_frame&&BOOMR.window)try{BOOMR.boomerang_frame.document.domain!==BOOMR.window.document.domain&&(BOOMR.boomerang_frame.document.domain=BOOMR.window.document.domain)}catch(t){BOOMR.isCrossOriginError(t)\|\|BOOMR.addError(t,"BOOMR_check_doc_domain.domainFix")}e=document.domain}if(e&&-1!==e.indexOf(".")&&window.parent){try{window.parent.document;return}catch(t){try{document.doma

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14879), with no line terminators
Category:	downloaded
Size (bytes):	14879
Entropy (8bit):	5.217852889913246
Encrypted:	false
SSDEEP:	384:J+Ewl8QBLREOSUV0VdcQnMVBOpgXWJR189IN59qo7X0+:J+plnSUjQQOpgXWJRdqoQ+
MD5:	01E96E9FF5C360298D13581AD38E60A8
SHA1:	01EC886B3FA7DA345755F5C8DB0FA4880FA3AD93
SHA-256:	6DC5A41A72F6C1B4148D0629284183A4DB42A28FEF188FF4D55D5872D0EA3561
SHA-512:	107B237D1ADE6F2DD6D4D3AA852DA4A09ADCA06EDD9A5195A6EA4996FD010688E748AAD0513DD8C84E3B0A563FA8D88E431C39C8E7573958BC606D631791C797
Malicious:	false
URL:	https://js-agent.newrelic.com/page_view_timing-aggregate.bd6de33a-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[348],{2573:(e,t,n)=>{n.d(t,{o:()=>c});var i=n(4247),r=n(1117),a=n(8673),s=n(8310),o=n(5763),u=n(3860);class c extends r.w{constructor(e,t,n){super(n),this.endpoint=e,this.opts=t\|\|{},this.started=!1,this.timeoutHandle=null,this.aborted=!1,this.harvest=new a.M(this.sharedContext),(0,s.L)(this.unload.bind(this),(0,o.Mt)(this.sharedContext.agentIdentifier,"allow_bfcache")),this.sharedContext?.ee.on(u.wO.RESET,(()=>this.runHarvest({forceNoRetry:!0})))}unload(){this.aborted\|\|(this.opts.onUnload&&this.opts.onUnload(),this.runHarvest({unload:!0}))}startTimer(e,t){this.interval=e,this.started=!0,this.scheduleHarvest(null!=t?t:this.interval)}stopTimer(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];this.aborted=e,this.started=!1,this.timeoutHandle&&clearTimeout(this.timeoutHandle)}scheduleHarvest(e,t){this.timeoutHandle\|\|(null==e&&(e=this.interval),this.timeoutHandle=setTimeout((()=>{this.timeoutHandle=null

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=*;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33674
Entropy (8bit):	5.005659976963834
Encrypted:	false
SSDEEP:	768:IQB919XDLzRxFlZ/CXZoxBI3gbeXm+gWzvG:IQvrDZKXZ/kp+XzvG
MD5:	BD6510FFA2C5B7C6854C7B39D3C6BFB0
SHA1:	4E977BD5B23723FFFFD4E80F4DDE661656735721
SHA-256:	66D785C2E3B9C31677F5744ECDD36B071608074AD069A8B692CEF7266ECBA880
SHA-512:	6030825FB636F0A4A04A9D4ABE13D3C8B6BE94FEE2E73F40F68777CD9AF8557507653A1F7B425D1B9D880318BAF2AD25BAB8830AC0472E1E67D2A852CB7D376E
Malicious:	false
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/accounting-software/"},{"name":"Hong Kong","code":"hk","href":"/hk/accounting-software/"},{"name":"South Africa","code":"za","href":"/za/accounting-software/"},{"name":"Malaysia","code":"my","href":"/my/accounting-software/"},{"name":"New Zealand","code":"nz","href":"/nz/accounting-software/"},{"name":"Australia","code":"au","href":"/au/accounting-software/"},{"name":"Singapore","code":"sg"

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20730), with no line terminators
Category:	downloaded
Size (bytes):	20730
Entropy (8bit):	5.462366852867757
Encrypted:	false
SSDEEP:	384:NeAMRQtDwxOBjhAJSgNtLGXaHdLs42DRZMJgoi8T:N7NNxYQadLTLi8T
MD5:	3303CAC12217337505CEB26EE9C5E199
SHA1:	B06CC32E27FF5FAB33A0AFE4D39FDEAE09ED6627
SHA-256:	4E05E1D81B72C19B8310BCF3CC1EAACA9EF09CA8BB5DE3777A801724A02DB6C1
SHA-512:	3877AC9DD72564B12B38A54A77FEC45809A25C25DADF3A994E23278DD7433D52DF40559029589DA69BD3CDF4EAB2A6939BB75669BCAA40FDD04AA22EFB11DD1E
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/638.106605aeaa4ef14523af.chunk.js
Preview:	(self.webpackChunkmy_bills=self.webpackChunkmy_bills\|\|[]).push([[638],{50193:(e,t,n)=>{"use strict";var a=n(41594);var r,o,i,l=function(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}(a);t.rs=void 0,(r=t.rs\|\|(t.rs={})).INITIAL="initial",r.PENDING="pending",r.REJECTED="rejected",r.RESOLVED="resolved",t.oY=void 0,(o=t.oY\|\|(t.oY={})).LOADING_STATUS="setLoadingStatus",o.RESET_OPTIONS="resetOptions",o.SET_BRAINTREE_INSTANCE="braintreeInstance",t.ul=void 0,(i=t.ul\|\|(t.ul={})).NUMBER="number",i.CVV="cvv",i.EXPIRATION_DATE="expirationDate",i.EXPIRATION_MONTH="expirationMonth",i.EXPIRATION_YEAR="expirationYear",i.POSTAL_CODE="postalCode";var c=function(){return(c=Object.assign\|\|function(e){for(var t,n=1,a=arguments.length;n<a;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function s(e,t){var n={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&t.indexOf(a)<0&&(n[a]=e[a]);if(null!=e&&"function"==typ

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	113591
Entropy (8bit):	7.997941021972184
Encrypted:	true
SSDEEP:	3072:9jpidW9VpCeYwNzFVZnGRRp1j9x6yXcQUumk7RJFEERAvSZ2ozGcuvaebi:9tFQwNztnGp1jCgVUpyMEWvSX
MD5:	A48124DC9DEF7B6997A68C2D38037AC4
SHA1:	1CDB63094D591AD4749B32C8D24B793A5A9795E5
SHA-256:	64409879C1E7080AD2056B7FFA0B97B108AB2E565EC78122537FEAB496B96DC7
SHA-512:	A8C7CAB24F422A218CA0EE71E1464A3513FB122328602F1502DB740F7A9ACD3079E3FB1736AA5671010552A5E503C817687692013DE244EA71D6DB005E4716A4
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/events/xero-beautiful-business-fund/BBF_Dotcom%20Landing.1692594732982.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@..................'.......)d.........S...8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe................pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe................pixi............ipma..........................iref........auxl..........mdat.........P2.O...$P..4g.T.Y...././..5..e.4e8........Q.P..Tf.i.....f)....+...a$`9......#...Q..............wZ.g$`.\x...w.X...t.P...L.:L...U13....>.E.X._.F,.....P/...dd.Io......?...<#...yB.R...MF.(..m9y..8..T.I-y./.>=G..".....~.......'.B......)/p.`.I..8.k0,.Tb&......o.2.~...!.B.P.1bJ....<.&.../^;z...........p.I1......Nx.HL6..2.[.....!..f.c]N..6.A~....? _`.Q2.+w[k......Y..\|..._.!..4:.."..........b.u....u<...A.x..N>..[.e.<.....j6LY..B..w.h.!/.f..;A....C.j...T.s.0.2..i....M.....-j.?....q...L(....(....\......[.U...D/.}.`"....

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=1i071nc
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (528)
Category:	downloaded
Size (bytes):	877
Entropy (8bit):	5.351084484518089
Encrypted:	false
SSDEEP:	24:si2N1V4NxwZG1tSbjCB7rSbjZ45Sbj/jzyY:rN3qOB7yZz5
MD5:	2BAEABB1FF781603A3719FE2E9B65ACB
SHA1:	31E788D7E52757FB81F3C8C0F43C0CD0D90AE5D9
SHA-256:	9698879F306B089C09FE178F12AC19EF2DA8A39222F15567238CE6AF83E287B7
SHA-512:	29178CFC033A02DE672BD9002324E04F8F5E757A245D89E38EE4BB55EDB0AB17C6649ABB94A130A9B5D88C04504C2BA05ED9C82F6B64046C9C03832AAA6D934A
Malicious:	false
URL:	https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/signup/
Preview:	.<html>.<head>. <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script>.</head>.<body>. <div id="universalPixelContainer">. <script type="text/javascript">. (function(global) { . var ttdcm = new TTDCM(); . ttdcm.init( ["https://uipglob.semasio.net/tradedesk/1/get?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b294347&sInitiator=external&_url=https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm","https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=e09cd2aa-7185-40a5-bf74-4fc29b294347","https://cw.addthis.com/t.gif?&pid=41&pidt=0&pdid=e09cd2aa-7185-40a5-bf74-4fc29b294347&cu=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dcrosswise"] );. })(this);. </script>. </div>.</body>.</html>

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151696608&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5258)
Category:	downloaded
Size (bytes):	5259
Entropy (8bit):	5.060180329787528
Encrypted:	false
SSDEEP:	96:D95qbslDCpFqImxwoD9N9JT3c5E/9CQipDwdGOddh:h5TdCpFqImxZ5NvAE/9PipDwEOddh
MD5:	FB9F7DAE39619642ED5890E40763EF2E
SHA1:	BC50FA89795E534B7E417E834C70CB674A9D30B4
SHA-256:	70712C8650FEECC46403B5801B9D5B72D5B2D6BA1D1CF0317E105603982321BF
SHA-512:	4E710BEA7BB3C8534D12D485260466B15785C6286CBEBE7BC562B9AD020A6E87A70139385FA6F1338F9048E1787ECF3FA4C48821675153F68D9BDFEA47E926DA
Malicious:	false
URL:	https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js
Preview:	!function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e){return function(e){if(Array.isArray(e))return r(e)}(e)\|\|function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]\|\|null!=e["@@iterator"])return Array.from(e)}(e)\|\|function(e,t){if(e){if("string"==typeof e)return r(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n\|\|"Set"===n?Array.from(e):"Arguments"===n\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n)?r(e,t):void 0}}(e)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function r(e,t){(null==t\|\|t>e.length)&&(t=e.length);for(var r=0,n=new Array(t);r<t;r++)n[r]=e[r];re

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696487&i=gtm&dwt=79&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151745123&i=gtm&dwt=9&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1464x1464, components 3
Category:	dropped
Size (bytes):	92054
Entropy (8bit):	7.9432464272422125
Encrypted:	false
SSDEEP:	1536:Fq4pKVckYrDedGVYMpEtrxbYQm0+DdENvaf3JLPw9iKBbOhI:ZEfYrJeKEVxEB0rm3JCc6
MD5:	CBD296C3CC2B12F67F09D39A0FC63DD6
SHA1:	29BE208496087C9E1F54D473E3CDF78443314C79
SHA-256:	6B138E2D8632991105E0E6B1E962A04F6D7F881F38D82A3AC0FB61BC40A719D2
SHA-512:	4BCE5A659DCE593B1C559A22F567D45F16B0099385A2B26132B0F1BC31F54D34F35FF85E79B397495ECC25ABED2FCCC15F9BF12DB31A0E96F252BDAEDB9028B1
Malicious:	false
Preview:	......JFIF..........................................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F............................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F..........."..........4.................................................................h...XB.d.Z..Y..wa.Q.-.b.$j.SXEBMYM.)...:.i..g....Z....VU....%.....\.)tQ8F+.%..I+.QCb..H.+.%.T.i.I.Q.. .V.cfYz`.8.8.fe\.h.`]Y.E,.F.H\...!.j$..Ne.....5gd96......y+.Ye.=79..cN.gAs.f..@..V#..(..l.:...Z\.h+i.YZ.......@d$..a0$%.I[...J...#T..U..PH5..i\Z..I.M...Q.!@.......Pk(U. ..H...TRE.".QH.VI...CT9....b..U.XR)..X.n\U5...J.I.V7s$..K.s........+.kx..s....%......i.(..uY].k\.7;Q....4.s.. :.\.4..I9V..@t.."Z`I5.M@.41.0.h5.&..!...D.V...UEE0...f....4e.s,t.KfZ.J.....D...h5..o$UNSQc.......#.+,.t.MX....h.W:.\|.S..k.5..fi...r.D..K:.DH.P.N.J..W...60....i..T....X.*KY...@.........2.C%$%...IS..L....y..D.)tR.\..eD..@.0.hc5Y$

Chrome Cache Entry: 674

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 675

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 676

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, progressive, precision 8, 887x710, components 3
Category:	dropped
Size (bytes):	44059
Entropy (8bit):	7.978011905566205
Encrypted:	false
SSDEEP:	768:8/CjQSp9hBN682D7P13CFl334xHIQ/xfHMlfRHNKhpTInKgE1J69MfC1WQ:8/Xy9sXDjlgYdIQ/8BUhpFq9Mq1V
MD5:	FA9DD2C18288AA5AC063BCF39A188C6B
SHA1:	F93EC5D77DDFCF457D353742126D5F1210FB56BC
SHA-256:	3ACD5AD26CB0F7E94F853572A0EF0F4BEEE74FA570D0F743461FF8B0C31D8B3F
SHA-512:	24E879217E111C1914AD086768A94B9915D8E776AABAC615E3A0BFD9FBFD4EF6C3F69CC4B3AE2348DFE477D3D0AB38EAAD4D561C90D3290316DB7D5BF3F48FA9
Malicious:	false
Preview:	......JFIF..........................................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F............................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F........w.."..........3.................................................................R............G.c..<.....1.N...o..35.u....Y:."`.+..f7g.y.G...W.J...YS.0EbP.f7......z..Q..(A....4.M..d.uL6...l.G{D..igh.y....}T[..+M.....OE..8]7S....$....+.z9.]....i.......Sw;-G..........s"..Q.V.n.+jS../..(N...[...k.....n%.V.....le.FT.9.g. .s.ru.H.F..d,F...o...c..gu...u.T..Q.L2.\.1V..=mTP.2....u6=......'..`.;X,..f9.j8...,[....k..1..2..`.OE..(]F..LNu."..J.zY......zGMq.0C...3.k1.. ....5.jq...\......7..!.':d/..V$N..O:..v.....6 ...:.,....(a4.....m=\.]a...Y,.m.K..'W&H..]Fa..v.te..(L%.#.*PRj..Di..(+...n.G:..`.`.f.]GR..u....[\)h..mV..1.[=..k..b.Q...i...<....).$z.53r...[...}>...>.......F.E..Tw

Chrome Cache Entry: 677

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 678

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151616852
Preview:	{}

Chrome Cache Entry: 679

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 680

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 681

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53433
Entropy (8bit):	4.989744933898178
Encrypted:	false
SSDEEP:	768:5LB919XDL1mwI3aB1WB4nn6PxpmkHh+Yh3TRR/txK3fNuXvG:5LvrtIiO86ZZh9CfNuXvG
MD5:	C90435C3963C7D4B7495B5BC8E60D4E0
SHA1:	BCD9BACB42B43DFC4700C4855D1C0553C49C97FF
SHA-256:	D3F88CA7B71363615C83F6DD199A4DBCCC0FD50D41B9A380C0D445014BCBA5B4
SHA-512:	F83546E97FF74EDDBF2B2FAE7BBC41388859EA401133BAFA371403B9A1DFAE6612A99F4D7FD791BBAFABCFA974C5195BFF56DF148A80BA829F12976F4D502CF8
Malicious:	false
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@oldId":"content-offer_banner-1115512261","@type":"xero/components/content/offer-banner","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/accounting-software/all-features/"},{"name":"Hong Kong","code":"hk","href":"/hk/accounting-software/all-features/"},{"name":"South Africa","code":"za","href":"/za/accounting-software/all-features/"},{"name":"Malaysia","code":"my","href":"/my/accounting-software/all-features/"},{"name":"New Zealand","code":"nz","href":"/nz/accounting-software/all-features/"},{"name":"Australia","code":"au","

Chrome Cache Entry: 682

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 683

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	32486
Entropy (8bit):	4.987386893886161
Encrypted:	false
SSDEEP:	384:wqxZB919XDLWT2Fc7/bx9puK7pIcp/phpjphpiQ+BZ6tkPJhRGF0NnvG:/LB919XDLJq5dxphxfJ+BZ6KPTRFdvG
MD5:	77FC11FA1986B4677BF3AA32C67427F3
SHA1:	1DD7FD9C65774EEC65B3C15795CE28B320852F43
SHA-256:	DE09B8EA91D88B0A1BD894BE0CFBF8E54028FEA3381761613CE257B583C191B1
SHA-512:	A0286714518425A520BC428D1F53A94987FFE2CCA031D96F71915ED912E16B4C7A8847EA0021082F12E9789B5F252519DFED79E72D41634C72AADA93F5A1BEA4
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/pricing-plans/early.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/early/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/early/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/early/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/early/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/early/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/early/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/early/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/early/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/early/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/early/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/early/"},{"name":"Canada","code":"ca","href":"/ca/pricing-plans/early/"}

Chrome Cache Entry: 684

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 685

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 686

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1085), with no line terminators
Category:	downloaded
Size (bytes):	1085
Entropy (8bit):	5.1249043891106725
Encrypted:	false
SSDEEP:	24:YCT5z5knwBD/1Nh/k2ry4PMD4yrrb+R5sNnFs:YCT5qnwBr1D7u4kkyrv+TGFs
MD5:	E43B565F398109176254B8A9394DE5BA
SHA1:	BE450710EAD4ECBBC6E1AA57FA1C3CB6D366F878
SHA-256:	D9BAFBAA07911D0596A806A1177DA26C107F735052D28603BC5EB8FA0DC63B55
SHA-512:	1995EB45FA3BEE129D028D4FD68988DEDCD2A8A9B88CAFBF3DFD85C09F502CCC8E00F034BCDFB7FEF33CBB0C3FA6C297C169FFC406B853CBC1381FAE7F798E4B
Malicious:	false
URL:	https://js-agent.newrelic.com/lazy-feature-loader.2f55ce66-1.236.0.min.js
Preview:	;"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[412],{8582:(e,n,r)=>{r.d(n,{lazyFeatureLoader:()=>t});var a=r(3325);function t(e,n){if("aggregate"===n)switch(e){case a.D.ajax:return Promise.all([r.e(860),r.e(148),r.e(898)]).then(r.bind(r,5039));case a.D.jserrors:return Promise.all([r.e(860),r.e(148),r.e(317)]).then(r.bind(r,1028));case a.D.metrics:return Promise.all([r.e(860),r.e(148),r.e(147)]).then(r.bind(r,9026));case a.D.pageAction:return Promise.all([r.e(860),r.e(148),r.e(78)]).then(r.bind(r,1832));case a.D.pageViewEvent:return Promise.all([r.e(148),r.e(786)]).then(r.bind(r,3609));case a.D.pageViewTiming:return Promise.all([r.e(860),r.e(148),r.e(348)]).then(r.bind(r,3307));case a.D.sessionReplay:return Promise.all([r.e(860),r.e(148),r.e(590)]).then(r.bind(r,2990));case a.D.sessionTrace:return Promise.all([r.e(860),r.e(148),r.e(733)]).then(r.bind(r,6209));case a.D.spa:return Promise.all([r.e(860),r.e(148),r.e(873)]).then(r.bind(r,2782));default:throw new

Chrome Cache Entry: 687

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 688

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (850), with no line terminators
Category:	downloaded
Size (bytes):	850
Entropy (8bit):	5.5954067132704575
Encrypted:	false
SSDEEP:	24:hMiRO9n7q4UsreLEDJG+RJ8G9P9HJGPHFBx:NO/weJG+ReG9FHJG/Fj
MD5:	1C9856B95C92D2659C11BCDF04C6CC1E
SHA1:	E4EEF9AAAAD30D3EEA594874A9F8FA7FC9B7398A
SHA-256:	7FEC9604D6E0D5525B7F8579DBA0DDA49147393154F34390FF73AE788C3E71B6
SHA-512:	15ED35614FF791942012D4CAE47071ED9B18611DC4C9E3D1DE4B6A94816B8E48849525A79110BF491E32A3DCCC6B97DD9FA25E9F5E01025F0255FB58F3EF718B
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals"/></body></html>

Chrome Cache Entry: 689

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1464x1464, components 3
Category:	dropped
Size (bytes):	45357
Entropy (8bit):	7.8014266532784315
Encrypted:	false
SSDEEP:	768:+xSPyFjMzK0ZNlf6iAZkGcRlUH71Rh68ru1Ers+60s2HPwB3AGjSI:fy+20ZNUiAaC5RhNrTsDFAQ
MD5:	19CE90B10570E0F4650231F3AB8F08F2
SHA1:	9C25CDBD675211514B306DBA28D8BD329557626D
SHA-256:	F828DAE62FE798952526E9FC9ADD0F67326325C556388E0FF78DCD96CD5F215F
SHA-512:	CC48B18A21B08A499133F4F5368E299F59FFF69B1009681D49F3654B000BFB9B702260B0F86D5769637FBFA8628C0FB1E94FDD7886DE948131021DB0CFDCD05D
Malicious:	false
Preview:	......JFIF..........................................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F............................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F..........."..........5..................................................................O.................................P.........P.......................A...........B......,....u..Q.E..Q.@,..%.A....................Q(...................`.T..B.X..............K.\.........(...%B..@..(................!l..".................D.)b..P@......K......&[............X.........`.....-J.......E....@..............................E.`..........Q(....T.(AR......Q.........@.... (.DP!P.(.Q............................`.............(.........e..B................,....."...............P.......(.@..........%........X....AA.PT....A`.............E.....^w7.o..9s^.4.Z..\|....U.,........k...=^N.z.............................)..

Chrome Cache Entry: 690

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151691548
Preview:	{}

Chrome Cache Entry: 691

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	14116
Entropy (8bit):	4.852751442895415
Encrypted:	false
SSDEEP:	192:bpJEjh35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM3Zv4s3G4e:VJi0v96QQFhjl9FoNAsrnM3Zv4j
MD5:	8CA97297BE710BC13598A924D240F6E3
SHA1:	7AC778EC5A31729472186C018050DA70BDF8BF01
SHA-256:	54157C66C194434743881750284E9840A570B93B5CFE2FBB09AEE7263DBE272D
SHA-512:	46555A2AF79C1402C48F025FB0AAFD5B2FE255F30F54B5B6D6E79F6320376549C34689F1ECA281852947B7B9B97786F00E38DB455DC51448B8F35CEE7B7F45CA
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/signup/early.json?next_id=1712725399
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"Early","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":true,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"1","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Set up your subscription","description":"Add your payment details from the Xero dashboard."},{"heading":"3. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["Safe and secure","Cancel with one month's notice","24/7 online support"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","promoCode":"SPRINGSAVE60","@id":"content-792953382","signupLocationInitialValue":"US","planPrima

Chrome Cache Entry: 692

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	369
Entropy (8bit):	6.872823617470407
Encrypted:	false
SSDEEP:	6:6v/lhPfgNIlM2M2M2M2M2M2M2MWIVIrkcyZqgWA9gHTScY3TrxQri3lwbgpBbket:6v/7DWrrrrrrrAAnITp2cY3PhVwKrJhz
MD5:	B42CB6EDE27D2B5BE4F43C79AB30B9F3
SHA1:	152DE95E673E17E835D94B714555C76F91FD8F16
SHA-256:	6F59F3FEDCC6D879B48025E6ABCCCCC0934818DBE3148419DBD8D62C7C744E75
SHA-512:	A8AF5ABB91BBBF1F6A54FEC64CE40F8D8403EA5143FA61645031DF1C09B07C59FF25CDD063E2B9D8171037809C1654A30069A941E6EF166E86DE2EDA9C7155F1
Malicious:	false
Preview:	.PNG........IHDR.............(-.S....PLTE<..<..<..<..<..<..<..<..<..<.....h..o...........R.......~..o.................u.....r.....p....................q.....=.......S.....E.......j....tRNS.F... ....^....orNT..w.....IDAT..e....0.E..6:.).... *....s&..........Rp.?...U....._.p.ry=........U...fk..C...l.g.....s}..[..;/\...W...>B....1.:)..?.....g~.....IEND.B`.

Chrome Cache Entry: 693

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	14521
Entropy (8bit):	4.865199432301464
Encrypted:	false
SSDEEP:	192:GzDEjh35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM0cvAPykLt9G4e:aDi0v96QQFhjl9FoNAsrnM0cvaykx0
MD5:	4ECA731F097F2CCD0BAD8BAAF40965D5
SHA1:	A84427DA73C9E96818D4B7D77EA708C84C743863
SHA-256:	B6E5FC1A9A652A3D2B673F0072805389950040D381B53655B025D425812585CB
SHA-512:	5413539638002D81D8D735F8E37DD1F92AED45C3CE0AED11131578BA6D39DF9782151DA3BE3BAFC71BAE1077D42B82C619320EBF5DB1E41BBFB1819427652EB9
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/signup.json?next_id=1712725399
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"30-day free trial","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":false,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"0","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["No credit card required","24/7 online support","Cancel any time"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","@id":"content--310370924","signupLocationInitialValue":"US","planPrimaryPoints":[{"excluded":false,"heading":"Set up with your data or a demo"},{"excluded":false,"heading":"No credit card required"}

Chrome Cache Entry: 694

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 695

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 729 x 733, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	11377
Entropy (8bit):	7.890567209099171
Encrypted:	false
SSDEEP:	192:DKEgoCgj/38Pf2Yg4lfxtnd+ZICMVcZ0ZMMOz3dUKzvumHCpqS1:Ddg9gzJ4lfHdsIjNOrdUKzvumHiqE
MD5:	4B2AB93362B5F9558F994FDF12E3CA7C
SHA1:	F74E8BE1B8F85457ECDB8BDD8C9646D497257D4E
SHA-256:	786ECD2A5D662201E7F7C7F829763E5B39166453C1C33B253CBF9FE306EE24D9
SHA-512:	5869117D8F4E6C909B2CD74EDA12CCA055A733031E1E21667101C03E1D35FF9457E447A40D9A7777A2709F26D5D03E79C0EEBABFA8AC880368661F3C5243AF4D
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/e7e2131e8ee7f228180e.png
Preview:	.PNG........IHDR....................fPLTE......................................................0..@.......p....... ........P..........`.............tRNS...@.p0...` P...n.m.....orNT..w...+.IDATx...b*;.E.y...!!...Ov.3e(.-Y.........P.........................................S....>.71....\|.JX.w.....h2......t.o..r<^.Fkk..........f<...............F......I.7..~.c...A.....c....Te9ie.b...A.........".l2.Z...]R.W..30.g7.oZ.....?.u.t53......Cn..7..Q...{rb...!.w...R.C....q......z[..Q.b..n............=.^.Zd..n..k.a.....-..@2.O<MYZ.w.Hv.p......M..........+..z.u.....K...n&.CJ.......tMk'r[.w.h\|..6.A.!.u.....sI.+....?\|{..q..-.......>.N%....h.....3.l.U..nY}........^vx...fR7+......W..ZWdVsK.u.......,..n..............K._.0...Q.Y.x.......Z&g....8...l.!M.'%.v..!..s....n..jH......]6{..:.n....5{....n.4..6..f.k::n[..M..5....M......v.lx.....v.lx.....v.lx]....v..)..f)V.6.;fc^F....kS.b.pi.Dg..'.6.#f..>D...^wkS;a.......ou.6..f. ...4.6..fc..n..-A..GY.mmj...!.Ve^

Chrome Cache Entry: 696

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
URL:	https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e09cd2aa-7185-40a5-bf74-4fc29b294347&expiration=1716743635&gdpr=0&gdpr_consent=
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 697

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 698

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	53433
Entropy (8bit):	4.989744933898178
Encrypted:	false
SSDEEP:	768:5LB919XDL1mwI3aB1WB4nn6PxpmkHh+Yh3TRR/txK3fNuXvG:5LvrtIiO86ZZh9CfNuXvG
MD5:	C90435C3963C7D4B7495B5BC8E60D4E0
SHA1:	BCD9BACB42B43DFC4700C4855D1C0553C49C97FF
SHA-256:	D3F88CA7B71363615C83F6DD199A4DBCCC0FD50D41B9A380C0D445014BCBA5B4
SHA-512:	F83546E97FF74EDDBF2B2FAE7BBC41388859EA401133BAFA371403B9A1DFAE6612A99F4D7FD791BBAFABCFA974C5195BFF56DF148A80BA829F12976F4D502CF8
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/accounting-software/all-features.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@oldId":"content-offer_banner-1115512261","@type":"xero/components/content/offer-banner","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/accounting-software/all-features/"},{"name":"Hong Kong","code":"hk","href":"/hk/accounting-software/all-features/"},{"name":"South Africa","code":"za","href":"/za/accounting-software/all-features/"},{"name":"Malaysia","code":"my","href":"/my/accounting-software/all-features/"},{"name":"New Zealand","code":"nz","href":"/nz/accounting-software/all-features/"},{"name":"Australia","code":"au","

Chrome Cache Entry: 699

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	116
Entropy (8bit):	5.13895988470968
Encrypted:	false
SSDEEP:	3:RNIJhyCnaz/p97GR3CRNkavIyx5nkCwICkY:RUyCnaz/zvRNpvIS6C0kY
MD5:	C154C78EEA9136BF399084876B20AAFD
SHA1:	888A4CE4C53B27E60E233DD74EE097C85A9C0F29
SHA-256:	97248B62F569F6D931E3ACEFF3A363CC994229D7F8EFFD5E3D052E995AB042FE
SHA-512:	A034A303E0596EAA9219DD96DE9F32BE798980908C05958AA891B86B52B684382D0CD547BDCBC6D23A8D00DC07940964C004CFFD1105D69389EAF7D0FA4ECBE6
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISOgkga7g-ObYmIxIFDfyM-aUSBQ02_qTlEgUNfsTQghIFDf45w-ESBQ3q4WA2EgUNqCwxsRIFDVNaR8U=?alt=proto
Preview:	ClQKCw38jPmlGgQIAxgBCgsNNv6k5RoECAUYAQoMDX7E0IIaBQiaARgCCgcN/jnD4RoACgsN6uFgNhoECA0YAQoLDagsMbEaBAgkGAEKBw1TWkfFGgA=

Chrome Cache Entry: 700

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14521
Entropy (8bit):	4.865199432301464
Encrypted:	false
SSDEEP:	192:GzDEjh35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM0cvAPykLt9G4e:aDi0v96QQFhjl9FoNAsrnM0cvaykx0
MD5:	4ECA731F097F2CCD0BAD8BAAF40965D5
SHA1:	A84427DA73C9E96818D4B7D77EA708C84C743863
SHA-256:	B6E5FC1A9A652A3D2B673F0072805389950040D381B53655B025D425812585CB
SHA-512:	5413539638002D81D8D735F8E37DD1F92AED45C3CE0AED11131578BA6D39DF9782151DA3BE3BAFC71BAE1077D42B82C619320EBF5DB1E41BBFB1819427652EB9
Malicious:	false
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"30-day free trial","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":false,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"0","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["No credit card required","24/7 online support","Cancel any time"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","@id":"content--310370924","signupLocationInitialValue":"US","planPrimaryPoints":[{"excluded":false,"heading":"Set up with your data or a demo"},{"excluded":false,"heading":"No credit card required"}

Chrome Cache Entry: 701

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14186
Entropy (8bit):	4.85225145795087
Encrypted:	false
SSDEEP:	192:dpCW2jl35FuvSg6aFQF1HdrFhz9FU/NAKDNLQmnM3Zv4UFG4e:fCWgov96QQFhjl9FoNAsrnM3Zv4d
MD5:	EB92B9A2C0C61C675C9C4AAEE39B37FA
SHA1:	4A51016261CA3F86912C12F5F52CC537FA5CECB1
SHA-256:	963B938AD700D468396A1E28AF4C3BBE87D7B2C97C29EC5F3DB430CB56A77EF1
SHA-512:	06D2A3870698C9519EA5F02F60387A9421D69D3DA7E7E4EE80F2839F8725AB58613CC0ACE80DC18127CE67F87D8736854DD8232EFE2292FB71D7ACF6C9FE7986
Malicious:	false
Preview:	{"pageProps":{"header":[],"main":[{"planHeading":"Growing","backButtonText":"Go back","recaptchaSiteKey":"6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh","@type":"xero/components/content/signup/smb","showSidePanel":true,"successDescription":"We sent an email to {EmailAddress}. ","buyNow":"1","successNextSteps":[{"heading":"1. Verify your account","description":"Click on the link in the email to verify your account."},{"heading":"2. Set up your subscription","description":"Add your payment details from the Xero dashboard."},{"heading":"3. Start using Xero","description":"Log in to Xero and start exploring features."}],"signupApiUrl":"https://www.xero.com/api/signup/v1","signupGdprLabel":"Please don.t send me marketing communications","signupPoints":["Safe and secure","Cancel with one month's notice","24/7 online support"],"successHeading":"Hi {FirstName}! Confirm your email and start using Xero.","promoCode":"SPRINGSAVE60","@id":"content--909067596","signupLocationInitialValue":"US","planPr

Chrome Cache Entry: 702

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1775x1420, components 3
Category:	dropped
Size (bytes):	100804
Entropy (8bit):	7.951547442046319
Encrypted:	false
SSDEEP:	3072:T9X9GUvUjJocXekoJ/niRLiNYGFNlmY3KuCsMEt:Td9GUv2dujJQLbGFN8punMEt
MD5:	AC5BBD827B9C7BA6C89E00168751FA20
SHA1:	2035CC96757E50356FA9A453488038EC462AA86A
SHA-256:	49CA731F707474B0F9ADA44246A2BF6B79F12349B6689B6416B663239587B419
SHA-512:	D8075EF8A90821157C95C5623EA68CD87667387AAC3B2E8E5D4D929B3D5A88201DF3AA3418760F6AB974DD6EC8C213377E38E4D9692C15DF3751F92DCB172AB4
Malicious:	false
Preview:	......JFIF..........................................................'...........'.<.%.+.%.%.+.%.<.5.@.4.0.4.@.5._.J.B.B.J._.m.\.W.\.m...v.v.............%............................................'...........'.<.%.+.%.%.+.%.<.5.@.4.0.4.@.5._.J.B.B.J._.m.\.W.\.m...v.v.............%..........."..........3...............................................................T.L.......@..Lb..c.H@.X..@..........C.1.... ....4.....&.....b.....!(........(..@..@..@............F..1.c....."(....@....b`.AoYk5W..]Y............l.!"...rZ.....^..d....M..j.e.....;....'qJn....da8....dr..Lz.M.}5i.....m-1.!......!X...@.. .....DX..@..@..@.... .b.!@............\K..i.......P1.@.........@..@..@.....@..@......DI!....(....#.9D$D$..1..".D...Y......".........c...NEN..=32.EeZ...Z.ei.w;jlU.j.n..f..'g.jy.u....p..Su5\g.#......NM7S....g....<.S.....DBN...H.H...4.@..&2,b. bc.. .@..@..... .+@....XF.RZ...[..qc. .......!..C.1..1..1..1..........&...".(.I.$........1.u...L2.k.5k...l`.H....h1...V.L.L.;.3.t..V.[..

Chrome Cache Entry: 703

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 704

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 705

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.6880630384772117
Encrypted:	false
SSDEEP:	96:jww8bS6XvHdjvkZl4a8RBxdxOT3xkzNAAA04aYWz50RxdJwJYpC/pJcVTJr0qsih:jww8b3XFjUSamBHgC5AAAFPRfh50qr6C
MD5:	C61C2614A52026A9833964DD82B0194C
SHA1:	44C86EA23C064983197AAE06CE7E17F729950D39
SHA-256:	A23CF2E7B89D854525BDE6330DC9301172477E78AD84BF26134A2730FE353D83
SHA-512:	247244567FA2838065B178A3C0D89421FE376BD623513705EAA518F49BF0D91EAFBF0C153B31FFB466968AC870A364D46D851A49639B82C0B128E56C3383C37A
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L..O..O6.PP.Pb.Pk.Pj.P_.PK.P0.P..N......................................................................................................................................M..O0.Pq.Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Qe.Q&.P..................................................................................................................N..PL.Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q..Q;.

Chrome Cache Entry: 706

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (41360), with no line terminators
Category:	downloaded
Size (bytes):	41469
Entropy (8bit):	4.937901511713219
Encrypted:	false
SSDEEP:	768:aaQB919XDLYDY83E3cLH0ozjiftdIYzan6vG:aaQvrIDY83Acz0oyftdtan6vG
MD5:	A1FFF261C856936623C6DBF210D6CC95
SHA1:	3679487CBD2E2B78AD4D44B4882B73A43D06FB4C
SHA-256:	3954AA9E9CFC5B01FB5D8FC18883B55A36E430B9B44676E8C326AF748F792204
SHA-512:	5974F142B222BE878C119D3E7BD347DA81A0F6A2EDA3F1152AF46AF6F0E076754B60D4D31A465C22A94E8FA25362DCD7071AE2D29216CDB9FD39677E077ED94E
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/legal/privacy.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/legal/privacy/"},{"name":"Hong Kong","code":"hk","href":"/hk/legal/privacy/"},{"name":"South Africa","code":"za","href":"/za/legal/privacy/"},{"name":"Malaysia","code":"my","href":"/my/legal/privacy/"},{"name":"New Zealand","code":"nz","href":"/nz/legal/privacy/"},{"name":"Australia","code":"au","href":"/au/legal/privacy/"},{"name":"Singapore","code":"sg","href":"/sg/legal/privacy/"},{"name

Chrome Cache Entry: 707

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.8013557344442175
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKVnIwN4wECWaee:PLKdXNQKVnDoCL
MD5:	284B36421A1CF446F32CB8F7987B1091
SHA1:	EB14D6298C9DA3FB26D75B54C087EA2DF9F3F05F
SHA-256:	94AB2BE973685680D0BE9C08D4E1A7465F3C09053CF631126BD33F49CC2F939B
SHA-512:	093F3F5624DE2E43E43EB06036107FF3260237F9E47E1F86FDFBA7C7036522187A9B47B291F5443C566658A8EF555E5033C7F2AC0C9F4FA8EB69EB8E2540B372
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js');

Chrome Cache Entry: 708

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46429), with no line terminators
Category:	downloaded
Size (bytes):	46430
Entropy (8bit):	5.303853365298302
Encrypted:	false
SSDEEP:	768:OaOFhhR5OIahpjfRys3LzQR04TYYyDMOWPKQ:OaOFnRqDRtzQ64IfWiQ
MD5:	72BCA04FD669EB89FC65D59052D0FC00
SHA1:	27E60AEF86F0CB1B2F6B6ED9DF9A4E3BA88EFD21
SHA-256:	823804A7807864B44093A3843788F4CD076E89CF4A6FDEB8D153AE5C2C2DF721
SHA-512:	56058E4C927563CA37DEC4979AF28A415EA3042A389C0BA22738C76D39131317A703A38A95EAB9D913F116F7C2D1DA62A0A87750F47DECA2DDB3447D64303B12
Malicious:	false
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

Chrome Cache Entry: 709

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1464 x 941, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	183143
Entropy (8bit):	7.974569383644727
Encrypted:	false
SSDEEP:	3072:SdwblRrKD+0cBFqXsO/GqBxRbeRJsA57k+q42qyDRERxRBINIwBuI:TplKGFqXZG0xR457k+q4ZsER3Blwz
MD5:	E79B8FB579B9F71FACF6D8E124549EFE
SHA1:	4977544DC6748A1347353E4471A4979E447D8D60
SHA-256:	9117513186FD261DB899294C63C2B84252341C946DC9E3DF0E0D622BF858B323
SHA-512:	E2D9CB6025E3C8F8E608A323FD5D75A694F534385EA892AE3028466340AC0D23501F7262E3F2E0632C76EFEB19E2668DA50101D20E1DED133545721E28B6B322
Malicious:	false
Preview:	.PNG........IHDR.............tI......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164050, 2019/10/01-18:03:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:dam="http://www.day.com/dam/1.0". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cq="http://www.day.com/jcr/cq/1.0". xmlns:Iptc4xmpCore="http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/". dam:Physicalheightininches="-1.0". dam:Physicalwidthininches="-1.0". dam:Fileformat="PNG". dam:Progressive="no". dam:extracted="2020-04-30T13:16:08.545+12:00". dam:Bitsperpixel="8". dam:MIMEtype="image/png". dam:Physicalwidthindpi="-1". dam:Physicalheightindpi="-1". dam:Numberofimages="1". dam:Numberoftextualcomments="0". dam:sha1="752aace032fa66ce6d500568e79df3c85cc6c024". dam:size="181692".

Chrome Cache Entry: 710

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.489310267001616
Encrypted:	false
SSDEEP:	3:fFwNyhIhBAdABiQmqDHX7Ctn:fFv+BAdA09n
MD5:	C61952726DB443720DEA16CBF8BC1BA1
SHA1:	AE3046CA4871FBC108341156161CF12629C92DC4
SHA-256:	01A72C4DF69AE32CCFDFE76D648C3BA4387E9C25DBFE7A53900C84C5BE61064B
SHA-512:	2C4F0D5937D5816FC294D79E2AE828356FD91D2AF91279C46187A245CC26C9FE0D7F0A3793AF9E35F98A64F333800EE4179A6EACE80F555D982F8C9B9925C2A5
Malicious:	false
URL:	https://tags.srv.stackadapt.com/sa.css
Preview:	:root {. --sa-uid: '0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757';.}

Chrome Cache Entry: 711

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2929), with no line terminators
Category:	downloaded
Size (bytes):	2929
Entropy (8bit):	5.971074937496678
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08hE43dec8pQXzo+2G9A4iEf:wsbSUtJfxrqLWWWdV6j1lE43sc8p7D4D
MD5:	655B3A13F85B1DF685B3E7A0AD29AAC5
SHA1:	C939F9F85248EC7E70C144CA6EC0C71D3B328378
SHA-256:	4465A3912C60377D4CBBFF7675A07DDD93BBDC399937C50CE68FAEC2126E9C39
SHA-512:	7ADD692BB738A6179AEED15EE4B69E86975F80F28883803E3FA59F63880D29F42422B6C4FB0C8C17E0D431A4C57873B367DEBB997E8939CEB829E60E108C10FD
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/1023673485/?random=1714151690667&cv=11&fst=1714151690667&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 712

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	294433
Entropy (8bit):	4.919897960135226
Encrypted:	false
SSDEEP:	6144:M7kl5uCRQSP3qQoCgLFQu4UBnwJUvGbjycT:JuCtPc4UBnGT
MD5:	2D6E56E859C536646B2F1A76684E2227
SHA1:	374864AE4D33D9F9CA6941DF489A4CEDC4A572F4
SHA-256:	BAFADF9C618FB3D866385426D8AABCBDE2E9983CDC3961CCC2A676A7D1EE438A
SHA-512:	A16B9A803D4BB71B59BC517EAE889472AC87E6536BC9E8B7A5807CD32D34164DE53F6AE4C075E08A633A81146D92BF9FBC2F3EB3B6D7B13FECE5CD6DFA98A417
Malicious:	false
URL:	https://edge.xero.com/style/xui/22.0.0/xui.min.css
Preview:	html{font-size:100%;-webkit-text-size-adjust:100%}*,:after,:before{box-sizing:inherit}body,form{margin:0;padding:0}label:hover{cursor:pointer}input[type=number]{-moz-appearance:textfield}input::-moz-focus-inner{border:0;padding:0}input[type=number]::-webkit-inner-spin-button,input[type=number]::-webkit-outer-spin-button{-webkit-appearance:none;margin:0}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}input:-webkit-autofill{-webkit-animation-fill-mode:both;-webkit-animation-name:xui-animation-autofill}textarea{overflow-x:hidden}table{border-collapse:collapse}button::-moz-focus-inner{border:0;padding:0}a{color:#0078c8;cursor:pointer}a:hover{color:#003c64}a:active{color:#002a46}a:focus-visible{color:#003c64}.xui-html{height:100%;min-height:100%}.xui-body{font-smooth:antialiased;-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;font-size:var(--x-font-size-medium, .9375rem);line-height:var(--x-line-heig

Chrome Cache Entry: 713

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 714

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 715

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151615060&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 716

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:RFREYDA:jRLA
MD5:	A454F56F4DEF70095E30E7676718042E
SHA1:	DB6A025FAFED1D1AD75A6D8BBA133D473ECC58B0
SHA-256:	3DAE93A05EDD9DCFC1864B87178A31E0BFA93E1A9B1C486C6E9CBF73CAE87862
SHA-512:	70CDF04204F3D1DFFEAF7F925EEBF04EA720735625A3BE0375E4AAAF9030C062CE6CCE84607483B282D3F9DA3482E920F17C74E226961156B1612F64814E0365
Malicious:	false
URL:	https://tracking.g2crowd.com/attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/&e=undefined
Preview:	// Tracking File

Chrome Cache Entry: 717

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 718

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	92170
Entropy (8bit):	7.995697995803509
Encrypted:	true
SSDEEP:	1536:1Tk8Hp+aIHB7jDg0AckMXFX6IJsYax4sFI5BfkkgpQr9QppYZa2/YnjUE:1DHp+aIh73g07kMcIJ9a+DrfkzpceXYi
MD5:	4FC0F65C3485CB75DF3DDB3152AB02E4
SHA1:	B18E15B41924FECA102D4CEACFBCABDC3B75160B
SHA-256:	EC7AE8F29A21F963420B1B064C0BC840C4BC1BEBC540ADB9A65A0CCF9261C624
SHA-512:	AFCF679878CC6B40F12FCD5CE010BC50626A4C9C69F0AA5C7837DB131DAAE7FE4A6BE785E0A911C9550073418F57B5F34EED5EDB875D237A329F61002940BB9E
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/campaign/covid-19/homepage-wayfinder-covid.1646877502691.png
Preview:	RIFF.h..WEBPVP8X..............ALPH.X......m$5v.\|..U.>v..>&N\D}..br....m.A...o...zfv..1...!xK.2..px...L'.]4Ok/.....j..jy.BE......M.>x.;...:..w.3..5._Z.ea.7h$Y1 .4t..+lM..X.....0...g".......P^./.&..Z?m...6r$.r.uS.sM.D....-.r2.+.!... ..]...!....j>/.m.............................j......).h.c.....<.j't.;6.B.S...`..,..t...>....bC....?.n....)..MTR.....G..P.o.].#.].cO~.v$.b....E.NC......G..7".<......v.u.(a...G.[ o]......:..\|\|....g.t.Xu..W"T...vx.<..h...:s..q.g.@...i...8.@}z[...-..M..{....n.....]..;<..R4.g](k.".+zF.9.r.......5cS...._.\|....v....mT...s.?.`..F.....O...b....../Ndk....U..}..7.E...B{...T.q.g_M.....U.x..4...&Y..<.'.P......5..Tb.C...CNuvV.....+..T1`...u3l.<....\|......D......=..P[.U....M..>\|%.t..%.v..m....\Uv.~..7e..j7$s.pA.U..sr:{%..v.A..~....g.E..4_..Aa......7j..I..`qs.......D..o-).:.ll{.:U<.I.x.1..S..W8.M.i...N.fn.....;h.....Q0CqB:U<v.4.#a..4T*..~.D..=....rg...n...mW....9../.<k.#c.....T...l...Y...8..O...]f.=.#l;..}.3.F".S

Chrome Cache Entry: 719

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34825, version 0.0
Category:	downloaded
Size (bytes):	34825
Entropy (8bit):	7.994246701718072
Encrypted:	true
SSDEEP:	768:sV4PIVDKsfViomwzYwfMakiwWPnzJ1cTy2nDam1uZJdCHhc:sV4QZNViomCDM7hWLJq2Lm8dC2
MD5:	3B08EFF4E35F8664F766DC9A9CCB7C65
SHA1:	42DE1E6782EE87514139960B03BBE6DB664738B8
SHA-256:	B84C1765EA7A66D0442154107093E94221C50E0DCEDC66A37411E56256CF77AC
SHA-512:	D188B8BDAF97467989B837B7D18AAD18E157DDDE6B89E7A2D3EB83525D271461D5938B1181BE80CCF7EBA00971377385CCEB5A167239994B224BEBB84D1CD0AB
Malicious:	false
URL:	https://www.xero.com/fonts/national2-web-regular.woff2
Preview:	wOF2..................x2......x....q..3............H..4.`..`..Z.R..a.....P..;.6.$........ ..&....."[.c...c....u......s.=mw.....05..Mg..-uAd......nR..Z.HNB...t....m.5Z..4.-......U..K....0.....:.i...Tv....^jTz.:4%....P7w..>3\|.hq.$.]..f{.)D>...\d+=gs..........}.....c2.....q..?..;.&..+.j....9T(..0z......FA../....T.D....;.+,&..=...V4..I<.9.4......3..f.7...4..Y..D].{.Lnu.T..q....~y....s...$..ox.../...y~...{....h..9..{......(..0z.p.F...1.."..tZ........#....h@..(Y....F.....S.N.h.):ELl@0.0......>B.DA..M..m."u....u.~......H....{^...>...V.Y.eD.Bl.'c......,)..a.......s...:..'.u..$..g.....`\|.....Z?.....+.\|k.<......0..n%.n{..g.\B.0u....~...7.........d..7..Ou.3.>....A.s...@.....)zPJ...a.0l<......9......J.\a.....s.o..{Z%A......E...;0..r...W.{a....:.....cX.l.p.@I6..o...hK.....^.Q.T.J...D"##..@.`...p...6..;............xz.:.^k@..1.....>2.....EX'.r.C..:.:.{.(.$D.....k..s......+:.h....$....i..H..JL...:'.{.p0r.....y......[A..`.. ..w....h4..i,2.H..

Chrome Cache Entry: 720

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=4h3yn1f
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 721

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1387), with no line terminators
Category:	downloaded
Size (bytes):	1387
Entropy (8bit):	5.1799540592886
Encrypted:	false
SSDEEP:	24:iT5zohX4mZa5o0OIcGIcvQIqVIpQIKRFlqvIPLrCQXIqYlrdVW6ONQIGRi4CaLRY:iT58hXdoy0OchvQdVWQ9FlwuCWdYBAN1
MD5:	A097CB2068FB2D63E521CACF139C921D
SHA1:	6203EABF4D1E530431E33EACAFE8ADC1B44128FB
SHA-256:	C902FF18C7858648BE03999D4022C40D66AD694AE218EA4B1558E74703B854A5
SHA-512:	CB36140314C3E74400F53799AEE2260032B3AE61683386FE33E04AE0A6BF35405EFC9DD5FBDB56E3F797EBA99616925E321175B40254FF829AA2372E8C7CB2F3
Malicious:	false
URL:	https://js-agent.newrelic.com/session-manager.2a64278a-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[242],{3228:(t,e,s)=>{s.d(e,{setupAgentSession:()=>h});var n=s(5763),o=s(8e3),r=s(2177),c=s(4322),i=s(3860);class a{get(t){try{return localStorage.getItem(t)\|\|void 0}catch(t){return""}}set(t,e){try{return null==e?this.remove(t):localStorage.setItem(t,e)}catch(t){return}}remove(t){try{localStorage.removeItem(t)}catch(t){return}}}class u{constructor(t){this.domain=t}get(t){try{var e=document.cookie.match(new RegExp("(^\| )"+t+"=([^;]+)"));if(e)return e[2]}catch(t){return""}}set(t,e){try{const s="".concat(t,"=").concat(e,"; Domain=").concat(domain,"; Path=/");document.cookie=s}catch(t){return}}remove(t){try{return document.cookie="".concat(t,"=; expires=Thu, 01 Jan 1970 00:00:00 UTC; Domain=").concat(domain,"; Path=/")}catch(t){return}}}let m=0;function h(t){const e=(0,n.OP)(t);if(m++)return e.session;const s=(0,n.P_)(t).session,h=s?.domain?new u(s.domain):new a;e.session=new i.$s({agentIdentifier:t,key:"SESSION",stor

Chrome Cache Entry: 722

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	116
Entropy (8bit):	4.988874457690567
Encrypted:	false
SSDEEP:	3:EWN1IJhyCnaz/p9UQ2NCRUhR6gY0bN8hVnfHykyl:/myCnaz/sURUacwVn/ykyl
MD5:	1F9E08A3C8DD5A056CE823857F923BA2
SHA1:	0341BAC3469CD3CE29A3BFCD07C740A3A942B2B0
SHA-256:	19941A2A89B9752C3C4D367177F6795B7A1A411B1466D11EBBCE897DB8DAA42C
SHA-512:	314AD593B910BD418A9AC66D360825322827DD361842B3CF0BA0E241908C621A6A3F998DAB687F8426A13CA88778603C2CAC4D68FFFCB0C7940EDD785CC9DABC
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISMwlLSLr7CdbDQRIFDfyM-aUSBQ02_qTlEgUNfsTQghIFDf45w-ESBQ3q4WA2EgUNqCwxsQ==?alt=proto
Preview:	ClUKCw38jPmlGgQIAxgBCgsNNv6k5RoECAUYAQoSDX7E0IIaBAgJGAEaBQiaARgCCgsN/jnD4RoECAwYAQoLDerhYDYaBAgNGAEKCw2oLDGxGgQIJBgB

Chrome Cache Entry: 723

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	2.716326985350135
Encrypted:	false
SSDEEP:	3:tQTltaL5UJjV9GjUJjVE:6XG5UJjGjUJj2
MD5:	8E3DB10AF5A3E1CABE7AA67674E21188
SHA1:	E2314B0038DF2D49DDBE461F33A6797D4586CDE0
SHA-256:	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362
SHA-512:	A4F136016F4591E021D54F06141896581371828BF02F662A050B2A36567DFEC6068A4C758815D481E01BD7D68692329B5EE228C854AB2D85246D05B56692FB09
Malicious:	false
Preview:	[71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Chrome Cache Entry: 724

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
URL:	https://d.agkn.com/pixel/10751/?che=1714151636619&ip=102.129.152.220
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 725

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24605)
Category:	downloaded
Size (bytes):	41679
Entropy (8bit):	5.4936189279113625
Encrypted:	false
SSDEEP:	768:1keY2FL4rhkGfV8Cj7szizyzMzKNSu3eq9zdlN:qe/+hkGfVXFu5XN
MD5:	87B5ECAAFD0E88097CBBB1BBB7695FE9
SHA1:	085D5B2112BB1AFA26B03B94183B6EEDC2F076B4
SHA-256:	5AF5EE0B37B1F0EF31C42932BBF81424E4BB53E95E87A47E058625C1AF2245DB
SHA-512:	C760FA5130EF53C99F4DC88E8843500022E63B2324C1EC8DC6C8F510C31A3CB784F0D38908C6F932E96BD566A0464A11EFD723AD73E72CA99626138A48C73092
Malicious:	false
URL:	https://a.quora.com/qevents.js
Preview:	!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.qevents=e():t.qevents=e()}(this,function(){return function(t){function e(n){if(r[n])return r[n].exports;var i=r[n]={i:n,l:!1,exports:{}};return t[n].call(i.exports,i,i.exports,e),i.l=!0,i.exports}var r={};return e.m=t,e.c=r,e.d=function(t,r,n){e.o(t,r)\|\|Object.defineProperty(t,r,{configurable:!1,enumerable:!0,get:n})},e.n=function(t){var r=t&&t.__esModule?function(){return t["default"]}:function(){return t};return e.d(r,"a",r),r},e.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},e.p="",e(e.s="./shared/qevents/main.js")}({"./shared/Class.js":function(t,e){function r(t,e){function r(){if(i\|\|(t.call(c),n(h,e,a),i=!0,e=null),this!==c){var r=this.__init__;r&&r.apply(this,arguments)}}var i,a=s.prototype=t.prototype,h=new s;return r.prototype=h,r.extend=o,h.constructor=r,r}function n(t,e,r){for(var n in e)e.ha

Chrome Cache Entry: 726

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=206915&time=1714151688126&url=https%3A%2F%2Fwww.xero.com%2Fus%2F
Preview:	{}

Chrome Cache Entry: 727

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1388
Entropy (8bit):	4.181880697809376
Encrypted:	false
SSDEEP:	24:t4Q7zW9cohDIUVoOS4g21m/D1kQWZNvelnael2dG4aQZpmxcO:p7zAFhMMoygz/DO9gLliGspmKO
MD5:	D3BEAC69C062ABC96B9BD3DD4231F530
SHA1:	2F9406BD87B74B6ABD3472407221162C7B3F8157
SHA-256:	4A8B6268634CC24717516DC0086009E24EE6C1D7F15AF098092ADFE878CC5E61
SHA-512:	DAABAB34FE971599D7858D7B36230C3771D5524B69CD2409444037526A4758CA8B4CC619B14E15B709D1C5D869AAF7710797F62449D1D8ACDF13D52C859EFD29
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/admin/icons/social-media/youtube-icon.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 20 14">. <path d="M19.9134 10.3193c0 .1735 0 .3469-.0866.5203 0 .1735 0 .2602-.0865.4336 0 .1735-.0866.3469-.1732.607-.0866.3469-.2597.6938-.4329.9539-.2597.3469-.5195.5203-.8658.7805-.2597.0867-.4329.1734-.6926.2601-.1732 0-.3464.0868-.4329.0868-.9524.0867-1.9048 0-2.8572 0H3.4632c-.17316 0-.34632 0-.51948-.0868-.17316 0-.25974 0-.4329-.0867-.17316 0-.4329-.0867-.60606-.1734-.4329-.1734-.77922-.3469-1.038959-.6937-.17316-.1735-.34632-.4336-.432901-.6938-.08658-.2601-.173162-.5203-.259742-.7804-.0865806-.1735-.0865792-.4336-.0865792-.6071C.0865788 10.5795 0 10.3193 0 9.97247v-.5203-.69374-.60702-2.34136-.69374-.34687-.34687-.5203c0-.17343-.00000132-.43358.0865788-.60702-.08658012-.26015 0-.43358 0-.69374.0865802-.26015.0865772-.43358.1731572-.60702.17316-.43358.346323-.86717.692644-1.214036.34632-.346868.69264-.520303 1.12554-.6937369C2.33766-8e-8 2.51082 0 2.77056 0H16.4502c.2598 0 .4329-8e-8.6927

Chrome Cache Entry: 728

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs&host=https%3A%2F%2Fwww.xero.com&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 729

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=oMnuZZCLlIev7MKDWDZRAcYQu-VVo2Uu0fXilR4p2V8&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 730

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 729 x 733, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	11377
Entropy (8bit):	7.890567209099171
Encrypted:	false
SSDEEP:	192:DKEgoCgj/38Pf2Yg4lfxtnd+ZICMVcZ0ZMMOz3dUKzvumHCpqS1:Ddg9gzJ4lfHdsIjNOrdUKzvumHiqE
MD5:	4B2AB93362B5F9558F994FDF12E3CA7C
SHA1:	F74E8BE1B8F85457ECDB8BDD8C9646D497257D4E
SHA-256:	786ECD2A5D662201E7F7C7F829763E5B39166453C1C33B253CBF9FE306EE24D9
SHA-512:	5869117D8F4E6C909B2CD74EDA12CCA055A733031E1E21667101C03E1D35FF9457E447A40D9A7777A2709F26D5D03E79C0EEBABFA8AC880368661F3C5243AF4D
Malicious:	false
Preview:	.PNG........IHDR....................fPLTE......................................................0..@.......p....... ........P..........`.............tRNS...@.p0...` P...n.m.....orNT..w...+.IDATx...b*;.E.y...!!...Ov.3e(.-Y.........P.........................................S....>.71....\|.JX.w.....h2......t.o..r<^.Fkk..........f<...............F......I.7..~.c...A.....c....Te9ie.b...A.........".l2.Z...]R.W..30.g7.oZ.....?.u.t53......Cn..7..Q...{rb...!.w...R.C....q......z[..Q.b..n............=.^.Zd..n..k.a.....-..@2.O<MYZ.w.Hv.p......M..........+..z.u.....K...n&.CJ.......tMk'r[.w.h\|..6.A.!.u.....sI.+....?\|{..q..-.......>.N%....h.....3.l.U..nY}........^vx...fR7+......W..ZWdVsK.u.......,..n..............K._.0...Q.Y.x.......Z&g....8...l.!M.'%.v..!..s....n..jH......]6{..:.n....5{....n.4..6..f.k::n[..M..5....M......v.lx.....v.lx.....v.lx]....v..)..f)V.6.;fc^F....kS.b.pi.Dg..'.6.#f..>D...^wkS;a.......ou.6..f. ...4.6..fc..n..-A..GY.mmj...!.Ve^

Chrome Cache Entry: 731

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1774x1774, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	56066
Entropy (8bit):	7.995331445599941
Encrypted:	true
SSDEEP:	1536:muv9y36YLfVe5yKyg6A4MJYwOMEp3h8hT4wvL9Rp6gFS:muVy05aDA7zOM63e8wvxRp6US
MD5:	A0F7BB7ED0ECEFC8206359C98D39F792
SHA1:	955866F5F54115CBACEB02945B578D2DA0E237E6
SHA-256:	1BEB13B8A0B57A27E9A1E8A28E5CB885CAC50858E4FFE72CEEA9EDBCD7E45AF7
SHA-512:	97116D3BDC43F0EC338882B55BD3AD670A629A0197FAA9D4329362679AC95E8CE4D091D28B8AFDC4D7CC1837FCFDF155E1E84BE1E72ED5171EEE840F28271074
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/features/invoicing/create-and-send-invoices.1646877464818.jpg
Preview:	RIFF....WEBPVP8 .............>.v.T......h....gn.....6`.$..&g...t$..[......ru......~$....#..}/.m.....~fzr..9.7..._..5..._................?....^._...z....U.7....7._..\|?...@\|..^.../..._...g..i.Z..M............~.y...].x.&...o.@...^...zt...#..[...G.._^......V...g...q5Rr$....L..IM'y..#..N..0G.%4..:`."Ji;.t..D..w..<...U.>........G.......G.9..y.`l.".....E......M......PM..P.#a.....J....w...r.M..Wp #.}6YU.[....L\,..T..={....D...\....x.3...yPl...l....6.".....E..SFl.R.{1?.(.+.@..pQ.]..a...}.....{..../{L.s.L..e.;....6....G.!..y.c.N.P!.F.......pn..k.B..^...D.U...5..d_..g..y..3.&. .\|M-b.N.....M+H.F....$....PX...l[.d.s.V...[.n...eL..D........q6....-Q..dw..y...~Q..C...Oq.]..Ln8..S....f..]......`..h.].t.......Tv.#..A........c.....".....iT.1..2...Cc.!.....L.G..\.[!...._...q~w..V8`I8.2.V..#.Nk.PQ~.._.D...s..0#...b...h..V0...li..>.E.!...>..u...$..1./_.2(..[%V.X.N....\.* t..Oe...\._O.q..t.r&..'"dL8.r..=.FA.G..5...t...5.J.5!..>&......m/.{..H.1.....&

Chrome Cache Entry: 732

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&tag=DwellTime&ts=1714151730858&i=gtm&dwt=24344&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 733

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 734

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.54178832719941
Encrypted:	false
SSDEEP:	3:YAv+e9BAJ6YSm7XJHIzRNg+wjNXWRwFH1j66qVVJMdMQUWKLb+AHfgq+WRHYn:YAme2J6YBDJHIlNgDXWqH1jwVJMyb/4l
MD5:	F447C440ABF2B8AF203938329FE494F8
SHA1:	3E071AE6400D84FB2EBE38EAEE60E1161D9F4556
SHA-256:	11BBA994684E05187E8CB291F03254CE7810FB3EABBC900299F078F2E584550F
SHA-512:	BC05CEC72D8512A1CE483156BDCD963199EBFFD224D991AABAD638D3FA075CD7C96E20B20B85C7224925B8263143772174B3BC824EA258C0B196C83E03007C9F
Malicious:	false
Preview:	{"errors":[{"code":"media_type_not_acceptable","message":"The Accept header should send a media type of application/json"}],"type":"error.list"}

Chrome Cache Entry: 735

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.335852603689657
Encrypted:	false
SSDEEP:	24:t4QboLDqqHCfg/VtEAHqxJx2BSHNfieSX95rxhd7SNgO:pb0fHCg/Eoox2Et6eSFhd2OO
MD5:	899EDAE44877FBE0F00900319F56B99C
SHA1:	9B33DA58C16165D71574F5A0EFEF5E7FF1021DED
SHA-256:	C10F78A021974B7CBC3FE1211007D5B832630390AD1BD295F4B145177D2952BF
SHA-512:	20506B3E8FC320D6176CE66777128960F8DE488F287527965082B2E1481E116323D728E72C508E88B47F31761E6676EA3676CC63BBA9F4FE92F307B3CEC10128
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 19 18">. <path d="M7.16016 17.0336v-.1774V5.58804h3.81524v1.50833c.0887-.17745.2661-.3549.3549-.44362.621-.79853 1.5083-1.24216 2.4843-1.33089 1.1534-.08872 2.2181.08873 3.1054.79853.8872.62108 1.3308 1.50834 1.597 2.57304.0887.3549.0887.79853.1775 1.24216v7.18681h-3.8152v-.3549-5.6785c0-.4436-.0888-.8872-.1775-1.33086-.3549-1.33089-1.9519-1.86324-3.0166-.97598-.6211.44362-.8873 1.0647-.8873 1.86324v6.477c-1.0647-.0888-2.30686-.0888-3.63774-.0888zM1.30469 17.0343v-.2662V5.76618 5.5h3.81518v11.5343H1.30469zM1.03795 1.68578c0-.08872.08872-.26617.08872-.3549C1.39284.443627 2.28011 0 3.25609 0c.79853 0 1.50832.354902 1.86322 1.15343.62108 1.33088-.26617 2.66177-1.68577 2.75049-.35491 0-.70981 0-1.06471-.08872-.7098-.17745-1.15343-.70981-1.33088-1.41961 0-.08873-.00001-.08873-.088731-.17745.088721-.17745.088731-.3549.088731-.53236z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 736

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (724), with no line terminators
Category:	downloaded
Size (bytes):	724
Entropy (8bit):	5.609389275256098
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHrVNe4Usrec9I0n2sYTiUMGT2IWauKfYtaht:hMiRO9Eq4UsresIODA8G9P9p
MD5:	E12C4D5F40B8365431809F51833680DC
SHA1:	057B2A6F96CB824C8803501A7416C8981CC5EA75
SHA-256:	CE8F51F0F72EDE6A7988BEAD675B449515890F8D078EEBD7C2F8EB2C7C7AE594
SHA-512:	E48F8678E895065618BBDD3561A4B4BC037CC8E796430B326B836BCC673E0DCE3D340D5B8FE952D5948175FD6B7A7A6F008B3DE76CFB0F6883398E21278B4BCD
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=*;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>

Chrome Cache Entry: 737

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 738

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18187), with no line terminators
Category:	downloaded
Size (bytes):	18187
Entropy (8bit):	5.347759003709589
Encrypted:	false
SSDEEP:	384:s40C/Y3uOOpp9W89rzOv4m8Avx2kjEhNgyyuek:VjOOp281UsAlErPyud
MD5:	5C6ED25DCE803FD84288922B8928409E
SHA1:	3CCC10546AE12F160BACAC1E9E422AF091EA4A41
SHA-256:	480B06B23E574B4BF386FDE1A91145A4171F97AEB5EE800E4BE1850F29B1AD91
SHA-512:	FE9265D2E6EA4ACB7E0A87E08BEDFAF48BCBAD62BB7A86E73F9AE21C8437AF3334D2A9733C6BC47A12BBF54F97EC79271CB5300F90231614F407599D1B4C05E5
Malicious:	false
URL:	https://s.yimg.com/wi/ytc.js
Preview:	!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=0)}([function(e,t,n){"use strict";function r(){if("undefined"==typeof TextEncoder){window.Tex

Chrome Cache Entry: 739

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696665&i=gtm&dwt=2&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 740

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 741

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/1023673485?random=1714151677802&cv=11&fst=1714151677802&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Preview:	<html></html>

Chrome Cache Entry: 742

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695923&i=gtm&dwt=10&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 743

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9139), with no line terminators
Category:	downloaded
Size (bytes):	9139
Entropy (8bit):	5.28179916732701
Encrypted:	false
SSDEEP:	192:M6d9XOiXaJTScTaGnf/cXIiLQd3P2Tz5z6jlVYTGv:M6XXOiXa1SaaYXcPikz5z6jl
MD5:	86E4BFA6E50B4E6F89990D8B83FF9AF9
SHA1:	32C4E1DDA791DCC6CA680C6EE862504EC33D3E3A
SHA-256:	F994A546112B265CDCCF32E0B13A67B3999416BA5C7084C9C5044C182CC82B0C
SHA-512:	E79F040D86401377028F22AF488271A95349DE0984BA9B1B563AC891FCC1C3EB387547828A79E08B722BC5359E1BB8F27D341114C9763AF9A3650190754F1796
Malicious:	false
URL:	https://acdn.adnxs.com/dmp/up/pixie.js
Preview:	!function(e){var t={};function n(i){if(t[i])return t[i].exports;var r=t[i]={i:i,l:!1,exports:{}};return e[i].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,i){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:i})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var i=Object.create(null);if(n.r(i),Object.defineProperty(i,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)n.d(i,r,function(t){return e[t]}.bind(null,r));return i},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="./",n(n.s=27)}([,,,,,function(e,t,n){"use strict";t.__esModule=!0;var i=n(6),r=function(){function e(

Chrome Cache Entry: 744

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	2.716326985350135
Encrypted:	false
SSDEEP:	3:tQTltaL5UJjV9GjUJjVE:6XG5UJjGjUJj2
MD5:	8E3DB10AF5A3E1CABE7AA67674E21188
SHA1:	E2314B0038DF2D49DDBE461F33A6797D4586CDE0
SHA-256:	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362
SHA-512:	A4F136016F4591E021D54F06141896581371828BF02F662A050B2A36567DFEC6068A4C758815D481E01BD7D68692329B5EE228C854AB2D85246D05B56692FB09
Malicious:	false
Preview:	[71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Chrome Cache Entry: 745

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 746

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A56%20GMT&n=-2d&b=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 747

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=*;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 748

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 749

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (583), with no line terminators
Category:	downloaded
Size (bytes):	583
Entropy (8bit):	4.922866901699429
Encrypted:	false
SSDEEP:	12:yMgqGePXTK3Ay6DLDmjaU17nW21X04KKeatV4nR1XQoifr:yM/qkIF17nW21kbFnR1q
MD5:	A8CCD32EEAE2573B015B4AAC7604ED0E
SHA1:	8C9C97BEF485EDEA6E7752BEFFD4F3D8D51AA19E
SHA-256:	29108B508F3E3A2258B5FF26CD876D31B87D7861DCD999190E083D25228C8AB7
SHA-512:	B50319539ED61BB6FE3C7D1B4B838F2DDA2C5FD3A6D861F06D76F2F532BCB1CD6BC45A235B43EEA912666E9A2E5115A261D243F9ED5898743433023E22B81A0A
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/main.3cf9c16495486cc66bcb.css
Preview:	.sbt-ErrorComponent{align-items:center;display:flex;height:100%;justify-content:center}.sbt-ErrorComponent--heading{font-size:1.0625rem;line-height:1.75rem}.sbt-ErrorComponent--description{font-size:1.0625rem;margin-bottom:20px}.sbt-ErrorComponent--illustration{padding:0}@media screen and (min-width:600px){.sbt-ErrorComponent--heading{font-size:1.3125rem;line-height:2rem}.sbt-ErrorComponent--illustration{height:400px;padding:56px}}@media screen and (min-width:800px){.sbt-ErrorComponent--heading{font-size:1.875rem;line-height:2.75rem}}.my-bills-SharedLayout--loader{flex-grow:1}

Chrome Cache Entry: 750

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2400 x 2400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1705590
Entropy (8bit):	7.98469722950784
Encrypted:	false
SSDEEP:	49152:CmwYk8zO352Jx82uURKfQpXwd0v3Kr6fu0CrY:C/8z5x82ubQpXAgo6u0qY
MD5:	DD330FFBFA0339DBB60C7A621E01E2D7
SHA1:	FDBBA80A3776A5973886A482981A4C6E47135DC3
SHA-256:	138CA781E6BDA94CBEA8D53B1611B15D8D8243F0C466A43BB00ACED6FA3FC782
SHA-512:	EB9491F2034F483497E4D3EB7DAD1962077D63B59AFDAA7A55BD00B6A91488F552668271690DC5BC77050B8F747E8712F71830482C06D723E267BDA0202D6A75
Malicious:	false
Preview:	.PNG........IHDR...`...`......M.n....orNT..w.....IDATx...y.eY~.v~...b...r.,..T...T.HjY...I.....P.K..@ka..xX..i{.^@.^mX.....ZBH...P....\Y..SD.1...w.q.w.........G..{..{.....B7.~..K..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 751

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 127 x 125, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	7439
Entropy (8bit):	7.959458986017549
Encrypted:	false
SSDEEP:	96:mN9XXayL+GOzjWN9XahvfbgDF/nQbVUPAiFBMo6F0NajLFgk6Fq6xl+jEprwacsF:mNlN+rWjvpPJBMoLajL8c6b+j+sdQl
MD5:	ED5B990C1F6F92000B4C48C6592ABAC1
SHA1:	F53CDDAFD9936F28EBFB2AA148898143515F7FFE
SHA-256:	DCC988DFDCFCF2ED3A1E4A9337D042892A6576141C763252C38F53A6392D3429
SHA-512:	BC1F133A6CA971F3C7A5A7F0EF42A4DCBAB78C235ABD56A13EB0B5DF91C00841947F3C2293BDC9A7F8E5E7EFA82F9116BBC746BA850F34F451004368B7849D50
Malicious:	false
URL:	https://in.xero.com/api/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1/getLogo
Preview:	.PNG........IHDR.......}......u......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.]....>J.4..d#y/D..a.^$.11...&.....g..5q...7........U.......TT.AaX...Y..=9.-.V...0.......vW.........!B..."...../...?>....R<.....\|....;..Ee.n..o^AE[.F.qG9......l(y.,.....>.T8P._a..M._...c..6Nz..M........a...>..y..&.....?:....F8<..`.&-J?...]v...j.T.T.u...}.r!uy.J.xks............Hk..d..o.nKg....G0..x...T..M...je(lW..-M'.M......s.].vv.... ,.yB.U[s.....f.../t+.....\|....Owi..lm.."n(.....Bs......Y...-p[..V..m.l..lz.r.49.A....i."B#p...^..nS.....M...m.o...6._..,M.l.g........6.{..+...)...].`1...=..........\L.....Er../.m~z..A.^$.>..X.tt..c...)...."..V^H..V.O.j.B.....]........YV=....+..3...e.S@#.K...u...l.`.......~.P.+..+..3:.m..j...F.....w..v..F...@7..u.H..U.{....0W.!'..$Z.-....#,/............a.3.UE.w......p.W.......os.3m...\;o[N.K......."d.F..{..0..B.3...m.w.f{b[..Ms....>..go2W.!+..tNf.A...h.#/x.K..P..\|;w..LwL.....o6W.!+....u........K.....-9.3mw.

Chrome Cache Entry: 752

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2930), with no line terminators
Category:	downloaded
Size (bytes):	2930
Entropy (8bit):	5.962008922922259
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08pE4rEec8pQXzo+2G9A4i0F:wsbSUtJfxrqLWWWdV6j1dE4rxc8p7D4p
MD5:	D6551B5E09D538FEC774F7543F4667D3
SHA1:	7835E182270565C1332BA758FFE2C90C50590318
SHA-256:	AD4CFC1A60FFDA4910C61AE6254B40EBBA320E7E3A8A09AEEA8FC5E0C340025F
SHA-512:	CE9C8BDB8AEBA11D32DF3260549B4BFFD4D5329B4CA697B43E0FD47E50A787731D87FBCE7EEBD8069676B3897A75073F637C149E1ADFFBFE6E42DB4D6384E164
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/1023673485/?random=1714151627962&cv=11&fst=1714151627962&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 753

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (886), with no line terminators
Category:	downloaded
Size (bytes):	886
Entropy (8bit):	5.625943323625279
Encrypted:	false
SSDEEP:	24:hMiRO9+GVq4UBqgDJGgP0xi8G9PdD6JGPHFBx:NOMGr56JGgsxLG9luJG/Fj
MD5:	A7E7789C18100967EE7FEB5827C41604
SHA1:	26B69F438FA019269550E4E96857D4E14DF04ABB
SHA-256:	F71F29AD23BBB2E66B13608400EB18460B33EC64AEBB26879391B6A2D4F85AE6
SHA-512:	805683DDCCF00FA9DB00601AA580F8CEF15BE35E034B3FD5F47369D4B3096C7844FDBE2153618DDA6FCA94DBCE1BA4067A955E1BD0A49E5111134AC77A7005CE
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals"/></body></html>

Chrome Cache Entry: 754

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=A_Q7s4unGTnYm-YPVctf24Pt9G8KKVg5hW4EYiIohJM&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 755

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2F
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 756

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 757

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1405), with no line terminators
Category:	downloaded
Size (bytes):	1405
Entropy (8bit):	5.782903458583698
Encrypted:	false
SSDEEP:	24:2jkm94oHPccXAAbJ7bC+KVCLTLv138EgFB5vtTGJTlWtRcw1MuhtsLqo40RWUnYN:iEcPbhKonR3evtTA87b1Muh6LrwUnG
MD5:	CD7442DCCDCBADAC7E2E58E776B8F4B3
SHA1:	69226F6DD25A7ADF40F555D278B79810F3882673
SHA-256:	B84F27B626D1E14E918EDFFE2768291EC121EB49AE31F3744472E09CF37B5EED
SHA-512:	112882B011408FDCA3582F0688F1F1D128AEA6FE386A7435563DF3925C4AED9295CF5D152CD52908DD37B4DCF11E1095D509232D517604A9EE82CA65F916909A
Malicious:	false
URL:	https://www.google.com/recaptcha/enterprise.js?render=6Le6fDsoAAAAABLpuIc7lmLNZEa2f-gLLKbb4bnV
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var E='enterprise',a=w[N]=w[N]\|\|{},gr=a[E]=a[E]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/enterprise/';(cfg['enterprise']=cfg['enterprise']\|\|[]).push(true);(cfg['enterprise2fa']=cfg['enterprise2fa']\|\|[]).push(true);(cfg['render']=cfg['render']\|\|[]).push('6Le6fDsoAAAAABLpuIc7lmLNZEa2f-gLLKbb4bnV');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m)

Chrome Cache Entry: 758

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4179)
Category:	downloaded
Size (bytes):	211260
Entropy (8bit):	5.540645513051961
Encrypted:	false
SSDEEP:	3072:TQQaf5qZ3fhO++YcE8yG1LceF2/ea8LR9Wk9ARCzOQjSTnXDL9btIMP+jL:MQX5N+yYLceF+scTnXP9RIMG3
MD5:	33F24BFF57FB42E133739D57C15C4F54
SHA1:	B55418E9AC8EAE4B8E7AD77864BD138F06E0A427
SHA-256:	9B4F9F077D786AE6F2FD29C3A65A59FB19B2B5C585C823F0B04BEA63672ADCC4
SHA-512:	329CF481010FF205C59AFB217295B6C41D099A01C69F624F48C0F839761691235A4EC8C733E82FC6106A2B3E3912E862224F729F7AF686829A1FB635ECDB4033
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/destination?id=DC-9401320&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_1p_data_v2","priority":1,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"","vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":4},{"function":"__r

Chrome Cache Entry: 759

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2899), with no line terminators
Category:	downloaded
Size (bytes):	2899
Entropy (8bit):	5.9665972573649295
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08WE4Bec8pQ5zfMGc+2G9A4H:wsbSUtJfxrqLWWWdV6j1qE4Ic8pQ8D4H
MD5:	B1C702F1A02F23F069A9F0CDDA02CBC3
SHA1:	87D5098CE33553964EBE46D006EA2AEE88DF3868
SHA-256:	B5E13A2D17095BC8FCBAE71376A2475D50973092FF0002CE893FE03F24371116
SHA-512:	8FDE4C23C4EF2C1D2366C33F9D5DA79A40BD78B6BD16A27757C21DF6ECD89469BA52C95120F87437FDE0E67577AA8C5A86BDC5580C86A71008B1B00B32DB36AA
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/1023673485/?random=1714151677802&cv=11&fst=1714151677802&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 760

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://ara.paa-reporting-advertising.amazon/aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151679299
Preview:	{}

Chrome Cache Entry: 761

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1x1, components 3
Category:	downloaded
Size (bytes):	651
Entropy (8bit):	6.85063735794783
Encrypted:	false
SSDEEP:	12:FC9YM8fwy0lJ0Xx0WzOsvWGKkCHdcfmcGHMf/qXzUOrS07DAzEgOsvWGKkCHdcf8:49YMWbo0XxDuLHeOWXG4OZ7DAJuLHenU
MD5:	EF044AA4A2DB72A65786440CE26E3569
SHA1:	5BE33DDE4971E52455C3B41890A4CED2059CE7FE
SHA-256:	3E55AAB534EB5C4B4D5C6E17E2AF54D71E9C856133EFA25690122ECE1C276296
SHA-512:	E8B709471F4C66A4B6CFC357E3C6ED6C08AC136DDB15EEB263940B8FE3336840A9B3AEB44B2D8CD665A3C19A8425BC0DE6E20F03542B20D92C7599A99299D323
Malicious:	false
URL:	https://tags.srv.stackadapt.com/sa.jpeg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?...]M...[.B.p:..GWf...

Chrome Cache Entry: 762

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	31968
Entropy (8bit):	4.9909561547420225
Encrypted:	false
SSDEEP:	384:IQxZB919XDLWT27b/b09puK7pIcp/phpjphpiQ+BZ6tkPb50NhvG:VLB919XDLnY5dxphxfJ+BZ6KPiDvG
MD5:	8282D83C25A7A80E3854CBFDACF36E79
SHA1:	0494A0AF76DC1340A49A7D2D64A97E1B3D883D30
SHA-256:	8C656E735F717A8F3DB8AD420BD4ECE53705E600F958A7611B258EC2175902ED
SHA-512:	E5D7EAFAF3D492333F2ED55E008B673E425FBF6E18D6BF7ED3B2C37FAC3AF16FB9529A4915EA35920F564447BEAA88A03F11686AD4BBE6FEDF2DC01B87A87533
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/pricing-plans/growing.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/growing/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/growing/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/growing/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/growing/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/growing/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/growing/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/growing/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/growing/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/growing/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/growing/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/growing/"},{"name":"Canada","code":"ca","href":"/ca/

Chrome Cache Entry: 763

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (24077), with no line terminators
Category:	downloaded
Size (bytes):	24082
Entropy (8bit):	4.970167624428361
Encrypted:	false
SSDEEP:	192:1Y9f2ZO091tHjrH5wI53JOmddRLuNiYHD28lrTlpClvMBDbpcxTVeBKWZG4X3maw:1Y9f2ZB919XDLWT28lr46GIBi0B9RvG
MD5:	DBBFB00BFAFFA1F384943EF1576CBA71
SHA1:	E30EE5989ADCEC35787906EE39390519595A17D7
SHA-256:	7B2BF2443B2C2045904F71AE050B43A29E8A22F4B17C7B790DC9E9D024909EF4
SHA-512:	3DC9311B9B642D2B9596DE5F2D76244C9FCFCCBB173059DEB769A218854D70AEB4632F00B9066CE086859F9C9C20D8114CF00109698D60146440DB24E9451B05
Malicious:	false
URL:	https://www.xero.com/_next/data/next_id/us/legal/offer-details.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/legal/offer-details/"},{"name":"Hong Kong","code":"hk","href":"/hk/legal/offer-details/"},{"name":"South Africa","code":"za","href":"/za/legal/offer-details/"},{"name":"Malaysia","code":"my","href":"/my/legal/offer-details/"},{"name":"New Zealand","code":"nz","href":"/nz/legal/offer-details/"},{"name":"Australia","code":"au","href":"/au/legal/offer-details/"},{"name":"Singapore","code":"sg"

Chrome Cache Entry: 764

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A48%20GMT&n=-2d&b=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 765

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34055), with no line terminators
Category:	downloaded
Size (bytes):	34055
Entropy (8bit):	5.382034135784619
Encrypted:	false
SSDEEP:	384:CmtU3zNc77tfmGarhLGWR0A/EssX94hQ106ZqnW7v2CViWWY2yrN1/oX1xrJfHG5:CmtEzE6hR0UEssX94hQfqAic2xHmqgD
MD5:	ED99E2C2B7E432BF1B01B17E26FEA4F1
SHA1:	31B19A9F34FEF2D8C779585F4477CD05A6784FAA
SHA-256:	C64B612E535BAE0B630160E4B0054682C16C475EE18FB18CB2ACF0E92ED99A84
SHA-512:	48E524BD8721D7DDFCEBB9EDFF0D980AA1789193001A61AD53D6A5A5C1EBF09906E4E2591311D8F831A3E83BBCDC3348D5877BE7ED88C475288A6CE4ECBE804F
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/locale.en-NZ.4a8119cde29ca710e9f3.chunk.js
Preview:	"use strict";(self.webpackChunkmy_bills=self.webpackChunkmy_bills\|\|[]).push([[229],{8301:e=>{e.exports=JSON.parse('{"ACCEPT":"Accept","ACCEPT_MODAL_HEADER_MOBILE":"Are you sure?","ACCEPT_QUOTE_ERROR":"Sorry! An error has occurred and your quote has not been accepted. Please try again.","ACCOUNT_NUMBER":"Account number","ACTIVATED_YOUR_ACCOUNT":"Activated your account?","ACTIVATED_YOUR_ACCOUNT_MESSAGE":"You should have received an email with a link to activate your Xero account.<p>Have you activated your account?</p>","ADDRESS":"Address","AMOUNT_DUE":"Amount due","APP_NAME":"My Bills","AT":"@ ","ATTACHMENTS":"Attachments ({totalCount})","DOWNLOAD_ATTACHMENTS":"Download attachments ({totalCount})","AUSTRALIA_BUSINESS_NUMBER":"ABN","BANNER_COMMENT_SUCCESS":"Your message has been sent","BANNER_ERROR":"Sorry! An error has occurred and your quote has not been {action}. Please try again later","BANNER_MESSAGE":"Thanks! Your quote has been {action} and {orgName} has been notified","BILLING_ADD

Chrome Cache Entry: 766

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://s.yimg.com/wi/config/10175613.json
Preview:	{}

Chrome Cache Entry: 767

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 21980
Category:	downloaded
Size (bytes):	6759
Entropy (8bit):	7.970766444142892
Encrypted:	false
SSDEEP:	192:4HB/Zow1k0DgHJTULAcyInTYrnqJPdu3o:anL1kygHJTUVyInUrqJVD
MD5:	15864CE88FA79A3E954417D0C3396798
SHA1:	FB9C3441942954B8EF8D637CDB307CBBAE25DA56
SHA-256:	97FDE46829E88416162D1CF2BA9C0BDC0A5C45D826ECF44095782AFD7417C500
SHA-512:	AC2B648224C8DD20F4BF5DAE9A4347C57B9902AE554E84FD3506F8B3B1E7759B33CB937B04D509E1DF06E4CBBF133C09D98A06E6FE8D30F639E4B8619E778697
Malicious:	false
URL:	https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
Preview:	...........\.R.H..?Oa4.niI.....L.EO.Q.....,A.V.d...H.h.'...H..{N..%.zf"f#.....'..;'..?.....y>.....$E..%./...l.o.7.V=q..%):,.LS/....q......v..a.}......".0.t..`yf.2]&.....8........&y.Eg..3..<...M..}..A8.).....?~8..xy}.....{..Y.K.........%....n.Q.e>.u.1..a.zA./..oo.........CN....5.d.cX5R'{.u..{....3.O...nn.._....,e./..M.H"......R.l$.....:.aJ.L.S.g...>#...-/$.<.g..i..[....O.............^..?.6...........g.u...............w8.w..v.=...........qog.w@..n.....%Y,o....r....%5Q......\..%Y1......!..SZ$....yyz....%...\.o.'I.1......`B.........>.<X......E......#..^..eP.....,`...E...H.4..G.v.T.A.J.Y...,....x.......!.B&.6...~0.....9.\|....4.HB.K .......,..J....!.\5+p.......94O...Ar....?..+K...>L7R..s...&.v.=+.{I..M.....D..Q..\T..%..H.....Qt..P.X...L#.g.H......O.xlu<X.........pD.lJ......(..!...V..E%.4N...z.J-...o.".~...BC....T.Qf.@..p...fS.../.R.....;3.a2.e.~>.2`Z.A..R$.X.......KZ\|..y.ei.GrI..d..P...e..d......(..(gF>k.P.>.H~.Wt...dP.KY.*".....{C515... .v.

Chrome Cache Entry: 768

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2763)
Category:	downloaded
Size (bytes):	2851
Entropy (8bit):	5.396953850248938
Encrypted:	false
SSDEEP:	48:Q5T5DVLKTvRFisYD9JLlPuDIpeKGFKN+oQpCTJsSv0lI2SRmQqYO68xohlK/Mesf:8iLisYD9I7vFKTQpcv+hQqYjkIEMeXKn
MD5:	CE1527DB8799A0BA1913B5C7B7F666AA
SHA1:	B1F70C926090FA9B21425E1DDBE201F2F78B6202
SHA-256:	FA44BA5620FC182EB36D66B9DEA560EDEB23AF9C3104647E39E2A4D3FABCF8CD
SHA-512:	AA38C3CE14C00087D64C107A55BB60D67969E728C3A57667A55BC95FB39258FDC2AECBD370797FF29A4F5D9C3D79B0C09F4C1EBCBFC4DC7DECB62A36565A87CF
Malicious:	false
URL:	https://js-agent.newrelic.com/async-api.30bd804e-1.236.0.min.js
Preview:	/! For license information please see async-api.30bd804e-1.236.0.min.js.LICENSE.txt /."use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[439],{7872:(e,t,n)=>{function i(e){var t=this;let n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:500,i=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};const r=i?.leading\|\|!1;let a;return function(){for(var i=arguments.length,o=new Array(i),s=0;s<i;s++)o[s]=arguments[s];r&&void 0===a&&(e.apply(t,o),a=setTimeout((()=>a=clearTimeout(a)),n)),r\|\|(clearTimeout(a),a=setTimeout((()=>{e.apply(t,o)}),n))}}function r(e){var t=this;let n=!1;return function(){if(!n){n=!0;for(var i=arguments.length,r=new Array(i),a=0;a<i;a++)r[a]=arguments[a];e.apply(t,r)}}}n.d(t,{D:()=>i,Z:()=>r})},4247:(e,t,n)=>{n.d(t,{Be:()=>a,Ne:()=>s,Zx:()=>o,qD:()=>r});var i=n(385);function r(){let{isFinalHarvest:e=!1}=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return e&&i.il&&i.Nk?s:a}function a(e){let{url:t,body:n=null,sync:i,metho

Chrome Cache Entry: 769

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	79
Entropy (8bit):	3.9905520344529988
Encrypted:	false
SSDEEP:	3:U3KTDW3MiLLUHcjVXlVBnWJ:H6NLgHWXZnWJ
MD5:	708FD37768AAAC4FAC6B11B43BC538A3
SHA1:	A47D5B07394D4447EAFE830DBC6A4ACBCB40CF33
SHA-256:	F2205C30AB0D0A86CD0D715CF483BAFD550C0EA9D4DDB24E2C182F1D7F024144
SHA-512:	6BED68D78AC26DA769975B5C20D389173B36A1301CA1F118D8EF362DD548DDFF696AC84ABF774882982C4CC61B9F0D337A57BB4FA4E1C4C776F0D901152F3116
Malicious:	false
URL:	"https://bam.nr-data.net/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=8477&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1&be=3630&fe=7484&dc=7367&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1714151553247,%22n%22:0,%22r%22:20,%22re%22:1379,%22f%22:1379,%22dn%22:1381,%22dne%22:1381,%22c%22:1381,%22s%22:1382,%22ce%22:1637,%22rq%22:1637,%22rp%22:3277,%22rpe%22:3628,%22dl%22:3404,%22di%22:4943,%22ds%22:7367,%22de%22:7367,%22dc%22:7471,%22l%22:7471,%22le%22:7488%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=5463&jsonp=NREUM.setToken"
Preview:	NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':0,'sts':0})

Chrome Cache Entry: 770

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 771

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151675449&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 772

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	138
Entropy (8bit):	5.213278916391078
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHWbPun2GnNXC0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAWbm2GNS0MT6ZBAW8UZK3njW4
MD5:	7EBA7EB81FEE40CABB8596B910446C78
SHA1:	A2196C485B9F2D7BC6C6F3FD5F36DDFABB0C3302
SHA-256:	3580443E67004F0B66303521E9AF62BDF658E4DAEEB78207B4955D2A489E64EA
SHA-512:	40D4AC67E8B225396B3EA2392F2AF751F402F5BE0C706A094C990E8F9D0E4448F7AD7B5AB837E4964E22D54D38AEE3DD2B90563E6819FADFE560D2A9E7361708
Malicious:	false
Preview:	{"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 773

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 774

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.738149333192866
Encrypted:	false
SSDEEP:	3:CUWJ/3e:4JW
MD5:	6A43099D5C8FE991A7AA7EBACA53069D
SHA1:	5BCE2F0D57305C58C7B05BFCE29EBB39A18F5570
SHA-256:	3B7B8A4B411DDF8DB9BACC2F3AABF406F8E4C0C087829B336CA331C40ADFDFF1
SHA-512:	B82C6AA1AE927ADE5FADBBAB478CFAEF26D21C1AC441F48E69CFC04CDB779B1E46D7668B4368B933213276068E52F9060228907720492A70FD9BC897191EE77C
Malicious:	false
Preview:	GIF89a.......,...........;

Chrome Cache Entry: 775

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1x1, components 3
Category:	dropped
Size (bytes):	651
Entropy (8bit):	6.85063735794783
Encrypted:	false
SSDEEP:	12:FC9YM8fwy0lJ0Xx0WzOsvWGKkCHdcfmcGHMf/qXzUOrS07DAzEgOsvWGKkCHdcf8:49YMWbo0XxDuLHeOWXG4OZ7DAJuLHenU
MD5:	EF044AA4A2DB72A65786440CE26E3569
SHA1:	5BE33DDE4971E52455C3B41890A4CED2059CE7FE
SHA-256:	3E55AAB534EB5C4B4D5C6E17E2AF54D71E9C856133EFA25690122ECE1C276296
SHA-512:	E8B709471F4C66A4B6CFC357E3C6ED6C08AC136DDB15EEB263940B8FE3336840A9B3AEB44B2D8CD665A3C19A8425BC0DE6E20F03542B20D92C7599A99299D323
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?...]M...[.B.p:..GWf...

Chrome Cache Entry: 776

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (691), with no line terminators
Category:	downloaded
Size (bytes):	691
Entropy (8bit):	5.618265775403052
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHaMnFVNe4UsrecVn2y+XP4TiUMGT2IWauKfYtahr:hMiRO9nMnFq4UsrekpR8G9P9v
MD5:	AA4485A585D284E138C8B9A7139A303F
SHA1:	712495CE31FFEEB1D63E0BE1AD14963B8390659F
SHA-256:	BBE92B12814526E7824917DC3D1D92C8B0DECD21C1C85B6BDE2F515424A2EBD6
SHA-512:	1E6B26A71D7D6BDE6106A676FF64A3573D81123C419F2E09FCAD4524A23F9F9A8F85E513D8094EA9D37ADE9BCB993B0DCA724EF27EFEB41F16F958C088B3D7BD
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=*;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>

Chrome Cache Entry: 777

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 13268
Category:	downloaded
Size (bytes):	5172
Entropy (8bit):	7.959217412926552
Encrypted:	false
SSDEEP:	96:DHjCOiGsWXrqLxIAuTKYq4x8jAXtqnx11Mf4HNQki1/AjX+ES:DHjCOiG/e9IAue+x3XtqntI4HIAb+d
MD5:	C0A0EB66756DE21372EDD5E5F99F5DF9
SHA1:	258572978DE82EDAB428A2714B1553DA021089F1
SHA-256:	22012BC0428674906B0B13E482EDD437CC4B755A28D11F5FB304BABB4499453C
SHA-512:	E83C076AACCEB50615F151710F0A2F09F9EEF7AA61F223F4D21260560A47C93249196B0E25AEB56714A028091F3F0854F470119D12B06FD03EAD7A2C1B332CEF
Malicious:	false
URL:	https://js.intercomcdn.com/tooltips-modern.41f34148.js
Preview:	...........[.s.6..4..s.J."%..f.7n..q..M<.."!..E.$d...owAR?....w..mk.....b..]P...JY$....4....().L.&a..d4.$..E..?~..o.,.7.&.L.qs......].m.!.d...<.yaH..<6$..b.NS..0./V.T..cq.S..L.y..Z..K..>,.,...v,.%..X}.6Y.M...&K..s..4#h...,.f..v...f...8.m...M..g..d1...=.d#\..Z0<.....!4.^..l.i..dw8...{.k:^....]..yO.zf.EyVJm..m..i..$..a..!.E.e<D(.T.E&........8.J_.I9...i6......eY?..,....mOg#...j.'b.2...fi....K..%J.(..(.....\|...&i....Wy..y.4w...r..+..X.].O..&.../l.m....vd...y....Gm......{N..ux...q...:m..w`..:.ZO..y..Tm..;4..{-.kC.8Tm..v5....i.&...D,..C...`B.&..q..QW.K...s..F.{..[n..-..v.F.....n$k...=[...3v.N.F.#Y8t(....^O...V...:.].....U.](<.....;....pu.h..w.>.*,..:.u..E+..wx..qH..y...pk.12@.7..#..o)R...k.C.....6.3...j.A..5#p.NO}...wI.H...jwp...r,<4\.o.pf .\|:pr..{].h...h.-"U...=.i%..5...?...........j.a..A.zx...[....s:.[...q...N..u...i.Y...._@....m......~....:.........f.._......c.9:Qk4...>.5....X}......a.1..h.S...rB...B.R8..'.X.Q0......l0

Chrome Cache Entry: 778

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20843), with no line terminators
Category:	downloaded
Size (bytes):	20843
Entropy (8bit):	5.29909541305312
Encrypted:	false
SSDEEP:	384:1s5hvhug41rMGWYkhPY5AUBlEdilMi4146Kjqejrug11Tj+xj7IWcsAubZcdLyr2:e5F0g26ZejrP11TCxjJcsAkcdLoST1hd
MD5:	27EF55DDF9EDED9CF24CE8747E8BBE04
SHA1:	F188AC48F517044E643ABD24FEB4CC404FD6A7F1
SHA-256:	167C7894014A33B184A658A4883C24C20BBD158DC04B7FEF709F80A4BCA6A7D1
SHA-512:	5702005F5BCADC7D275AA273BE66BD24F0A9298B220E8246F63866CF44ACA5C39E1ADB8752F9B84755C338F92B412338DF2E77C6A929BAFB30DC164373CFD366
Malicious:	false
URL:	https://js-agent.newrelic.com/spa-aggregate.e6b09d52-1.236.0.min.js
Preview:	"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[873],{1199:(t,e,i)=>{i.d(e,{R:()=>s,z:()=>r});var n=[];function r(t){if(0===n.length)return!0;if(void 0===t.hostname)return!1;for(var e=0;e<n.length;e++){var i=n[e];if("*"===i.hostname)return!1;if(a(i.hostname,t.hostname)&&o(i.pathname,t.pathname))return!1}return!0}function s(t){if(n=[],t&&t.length)for(var e=0;e<t.length;e++){var i=t[e];0===i.indexOf("http://")?i=i.substring(7):0===i.indexOf("https://")&&(i=i.substring(8));var r=i.indexOf("/");r>0?n.push({hostname:i.substring(0,r),pathname:i.substring(r)}):n.push({hostname:i,pathname:""})}}function a(t,e){return!(t.length>e.length)&&e.indexOf(t)===e.length-t.length}function o(t,e){return 0===t.indexOf("/")&&(t=t.substring(1)),0===e.indexOf("/")&&(e=e.substring(1)),""===t\|\|t===e}},2573:(t,e,i)=>{i.d(e,{o:()=>u});var n=i(4247),r=i(1117),s=i(8673),a=i(8310),o=i(5763),h=i(3860);class u extends r.w{constructor(t,e,i){super(i),this.endpoint=t,this.opts=e\|\|{},this.start

Chrome Cache Entry: 779

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=2808008891046894518&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 780

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65282), with no line terminators
Category:	dropped
Size (bytes):	77066
Entropy (8bit):	4.899158540911283
Encrypted:	false
SSDEEP:	768:uVQB919XDLYeujvaZSD/hwBqN9VbJg49RzJ+mt7gtBlM2FgtcVXZPanjvvG:uVQvrIeujCZSD5PJ+mt7GOqVJijvvG
MD5:	CA7470FDBCAB948A8AEEF40A9B5C0114
SHA1:	D606ED84A2079F31ECDCDD6106AF1919E9978D06
SHA-256:	3692D352533EDFE3CFCE7EA38DAE62C06103563DD5C029EAC256E18275AFD30D
SHA-512:	DE25B8C903ACC7A94C8873F52643A56FA36A2F6B89574D805AF543A727A8F57DDE22FABECB1E6B3E4A5419D42A2108743B8B3A099180A486E7E5E9CB9CF07338
Malicious:	false
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/legal/terms/"},{"name":"Hong Kong","code":"hk","href":"/hk/legal/terms/"},{"name":"South Africa","code":"za","href":"/za/legal/terms/"},{"name":"Malaysia","code":"my","href":"/my/legal/terms/"},{"name":"New Zealand","code":"nz","href":"/nz/legal/terms/"},{"name":"Australia","code":"au","href":"/au/legal/terms/"},{"name":"Singapore","code":"sg","href":"/sg/legal/terms/"},{"name":"Philippines

Chrome Cache Entry: 781

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A50%20GMT&n=-2d&b=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 782

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 783

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 784

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	138
Entropy (8bit):	5.213278916391078
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHWbPun2GnNXC0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAWbm2GNS0MT6ZBAW8UZK3njW4
MD5:	7EBA7EB81FEE40CABB8596B910446C78
SHA1:	A2196C485B9F2D7BC6C6F3FD5F36DDFABB0C3302
SHA-256:	3580443E67004F0B66303521E9AF62BDF658E4DAEEB78207B4955D2A489E64EA
SHA-512:	40D4AC67E8B225396B3EA2392F2AF751F402F5BE0C706A094C990E8F9D0E4448F7AD7B5AB837E4964E22D54D38AEE3DD2B90563E6819FADFE560D2A9E7361708
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 785

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 786

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	338349
Entropy (8bit):	5.459383453283348
Encrypted:	false
SSDEEP:	3072:KVcCodz/5koZw023suKMWUd7FKV1Cn35+RA27D36ZGg+8E+rzZKBkCTs9:QMz/Vb28uKMX7IV1Cn35++2SZGuZ4s9
MD5:	2C4774C2A3D92E91B548D454CCC4E625
SHA1:	3B89905852CC7FA572B9B4A3EE35E81A0D8B3956
SHA-256:	AEF52CA4D81284D5F3347825CCB5916F5CAD4D3E1D58A5A38578B9DB1E50CDF1
SHA-512:	2D881796156EE1846659ED3B9619B4881B1E3E89F62ECCA6559033C517CF0D35D332DE9B73B51574DE8C10E6A44D76701EDB26BB35E216E53B38A2BB95944E59
Malicious:	false
URL:	https://www.xero.com/_next/static/chunks/pages/_app-eecd16c5dea41931.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[888],{7154:function(e){function t(){return e.exports=t=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},t.apply(this,arguments)}e.exports=t},6479:function(e,t,n){var r=n(7316);e.exports=function(e,t){if(null==e)return{};var n,o,i=r(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(o=0;o<a.length;o++)n=a[o],t.indexOf(n)>=0\|\|Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}},7316:function(e){e.exports=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0\|\|(o[n]=e[n]);return o}},9742:function(e,t){"use strict";t.byteLength=function(e){var t=c(e),n=t[0],r=t[1];return 3(n+r)/4-r},t.toByteArray=function(e){var t,n,i=c(e),a=i[0],s=i[1],u=new o(function(e,t,n){return 3(t+n)/4-n}(0,a,s)),l=0,f=s>0?a-4:a;for(n=0;n<f;n+=4)

Chrome Cache Entry: 787

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 788

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 789

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 790

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/1023673485?random=1714151627962&cv=11&fst=1714151627962&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Preview:	<html></html>

Chrome Cache Entry: 791

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 792

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26008), with no line terminators
Category:	downloaded
Size (bytes):	26008
Entropy (8bit):	5.400205313818421
Encrypted:	false
SSDEEP:	768:bMLh54I0JjKeb56IuCi6sqoGPASm0fHLXeh:I54dxGV6Tm0fHLXo
MD5:	83C0A3AE20BDB338DE5F1C32594E8A28
SHA1:	1BB16A48E3C00715C03F6DCCFDF886543F8C28AD
SHA-256:	24C6667BF50AF02C957012F598C561091A1C690B70C154762B8116BA887081B4
SHA-512:	6B3EDC6C1BC06C8DD4EEF2D1640F609F2CF3D7601FC92AA6E4E42686EAAE512D6BBB0F7B94394DBB1E8DDF69F9D9BD2172F9D8CCBE26A933E10BA4B38FFEEDD7
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/680.6aaa81dd750ad656b318.chunk.js
Preview:	(self.webpackChunkmy_bills=self.webpackChunkmy_bills\|\|[]).push([[680],{53233:(e,t,a)=>{"use strict";Object.defineProperty(t,"Ay",{enumerable:!0,get:function(){return s.default}});var l,s=(l=a(31806))&&l.__esModule?l:{default:l}},84278:(e,t,a)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var l=p(a(71508)),s=p(a(5556)),r=p(a(41594)),i=p(a(7129)),n=a(34900),o=p(a(94238)),d=p(a(83668)),u=a(74848);function p(e){return e&&e.__esModule?e:{default:e}}const f=r.default.forwardRef(((e,t)=>{let{characterCounter:a,children:s,fieldClassName:r,hintMessage:p,isFieldLayout:f,isGroup:c,isInvalid:h,isLabelHidden:g,label:b,labelClassName:x,labelRef:m,labelTagType:v,onBlur:y,onClick:C,onKeyDown:w,qaHook:k,validationMessage:M,wrapperIds:I,wrapperProps:E}=e;const P=(0,l.default)(r,f&&`${n.ns}-field-layout`),j=(p\|\|M)&&(0,u.jsx)(o.default,{isInvalid:h,validationMessage:M,hintMessage:p,qaHook:k,wrapperIds:I})\|\|void 0;return(0,u.jsx)(i.default.Consumer,{children:e=>{let{useFl

Chrome Cache Entry: 793

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24838
Entropy (8bit):	3.496915319918756
Encrypted:	false
SSDEEP:	192:xGyAUEQmLhHD+qI4nipKs3hc9ijtukd9R08c6weS:xNAUhAhjB7rsRc8jtuk7OOweS
MD5:	C169AEE3C6F710672AE66CDB0AE20879
SHA1:	CAA44FB392A6427C7E5C22437137CB771E717C53
SHA-256:	B5107D80D618E1824D266984E1673710D3A6D766E8B3997C52E1E271FB57FA49
SHA-512:	EAE8E4EF77CF5DDCA93303DAD6B1E23E6256426EE82D0E2E20F8869D4EBCDD88E3EDF3DA9755485C3B3857F286B32CCA5F60D609FC4ED5099A82714FB51CDE8D
Malicious:	false
Preview:	......@@.... .(B..F... .... .....nB........ ......S........ .h....\..(...@......... ..........................................................................................................................+..Y......................................].......................................................................................................................................................................................@..............................................................F................................................................................................................................................................v.............................................................................#...................................................................................................................................................................................

Chrome Cache Entry: 794

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 795

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64347)
Category:	downloaded
Size (bytes):	223683
Entropy (8bit):	5.454805360153245
Encrypted:	false
SSDEEP:	3072:tt8WClBZIncVuP0bteuvQ+AMPpgArl0xYu5GKnPt:ttlWBZ7O0bvQQGArHu5GKn1
MD5:	85F41014BE15CC3E54A4123C00C5021E
SHA1:	1E5468F507A8B0216114A8D8F63309BE8CBCAB9F
SHA-256:	01E9582655224C83E6C075F44B7EECB135E108B6AD2150BF6F78A0A77C4AD5E0
SHA-512:	78F6D6CD922AA42FD340CF215D7D91DDFABEF5EC393DFA5EB578436B9B668F839747218A4DE980AEC2395194667B1E0215623EC902EAAF8CE592536172414FCD
Malicious:	false
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 796

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695748&i=gtm&dwt=1&ive=webkitHidden
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 797

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 798

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	860
Entropy (8bit):	4.3770889600848975
Encrypted:	false
SSDEEP:	12:t4Pn4Xz8YipeOLDlOlcuhyY1pHQMOVVOam7aLfUAM++I+QX5W7e4A5:t4QDiAAicub1pwMaxm7Qy+1ZEO
MD5:	3DC20FF3068D347283B63ECBEDBC0F85
SHA1:	814B02876FD3B0614918F93DE30F077D045DA8F6
SHA-256:	0273BA68EDCAC94897E470DB55A0CBADB3752E0A86C59E3BC00D9C7AC73FB2DF
SHA-512:	4F2FF2F5179A91053CEDC9DFAC7A768E494F99D86F0827BB8D5F8957BBEF6A9CC174BF9B6230729940071975F1B0215A7AC849280F462C8BC07252BC7A36FFEB
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/admin/icons/social-media/instagram-icon.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <symbol id="ico" viewBox="0 0 17 17">. <path d="M10.19 8.5c0 .93-.76 1.69-1.69 1.69-.93 0-1.69-.76-1.69-1.69 0-.93.76-1.69 1.69-1.69.93 0 1.69.76 1.69 1.69z"/>. <path d="M10.35 4.42H6.63c-1.22 0-2.22 1-2.22 2.22v3.72c0 1.22 1 2.22 2.22 2.22h3.72c1.22 0 2.22-1 2.22-2.22V6.65c0-1.24-1-2.23-2.22-2.23zM8.5 10.93c-1.33 0-2.43-1.08-2.43-2.43S7.16 6.07 8.5 6.07s2.43 1.08 2.43 2.43c0 1.33-1.1 2.43-2.43 2.43zm2.69-4.48c-.35 0-.63-.29-.63-.63s.29-.63.63-.63.63.29.63.63-.28.63-.63.63z"/>. <path d="M12.06 0H4.94C2.22 0 0 2.22 0 4.94v7.12C0 14.78 2.22 17 4.94 17h7.12c2.73 0 4.94-2.22 4.94-4.94V4.94C17 2.22 14.78 0 12.06 0zm1.23 10.35c0 1.62-1.32 2.94-2.94 2.94H6.63c-1.62 0-2.94-1.32-2.94-2.94v-3.7c0-1.62 1.32-2.94 2.94-2.94h3.72c1.62 0 2.94 1.32 2.94 2.94v3.7z"/>. </symbol>. </defs>.</svg>

Chrome Cache Entry: 799

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151684059&i=gtm&dwt=1377&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 800

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 801

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	32340
Entropy (8bit):	4.985866177395701
Encrypted:	false
SSDEEP:	768:tQB919XDLs9Wn5dxphxfJ+BZ6KPh94SfC2vG:tQvr89WReSsh94p2vG
MD5:	AB75BFD8899B24789E58681D7532A6F5
SHA1:	0794C6E90A3650E06BC9A8B30674501EE542D96D
SHA-256:	0C738EA950AB6F26BF788BE4E2912EB8C7A2F9D5A844571E32F7D303C0CB7443
SHA-512:	58A151B2A455EA24AFAF365B383D3DABD87EB41CDBE098AE5D8B283EF9719A549B47F7CEA93143DA85F5AE7EFF850D445B74C4966204A05BF6FA6675E28B88E1
Malicious:	false
URL:	https://www.xero.com/_next/data/1712725399/us/pricing-plans/established.json?next_id=1712725399
Preview:	{"pageProps":{"header":[{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/pricing-plans/established/"},{"name":"Hong Kong","code":"hk","href":"/hk/pricing-plans/established/"},{"name":"South Africa","code":"za","href":"/za/pricing-plans/established/"},{"name":"Malaysia","code":"my","href":"/my/pricing-plans/established/"},{"name":"New Zealand","code":"nz","href":"/nz/pricing-plans/established/"},{"name":"Australia","code":"au","href":"/au/pricing-plans/established/"},{"name":"Singapore","code":"sg","href":"/sg/pricing-plans/established/"},{"name":"Philippines","code":"ph","href":"/ph/pricing-plans/established/"},{"name":"United Kingdom","code":"uk","href":"/uk/pricing-plans/established/"},{"name":"Indonesia","code":"id","href":"/id/pricing-plans/established/"},{"name":"Ireland","code":"ie","href":"/ie/pricing-plans/established/

Chrome Cache Entry: 802

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 803

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<html></html>

Chrome Cache Entry: 804

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4179)
Category:	downloaded
Size (bytes):	254621
Entropy (8bit):	5.546977078718378
Encrypted:	false
SSDEEP:	3072:V0JQaf5qZ3fhO++bXcS8mG1LceF2/ea8LR9Wk9As6UOQPGA28XjXDL9btIMxiShL:YQX5N+bBYLceF+oFXjXP9RIMnR
MD5:	C19F407BEC215FCF16DA2DB197E48D6E
SHA1:	DF33B876CA8B73BFAD7D7C9ED9D962A6A102CEB2
SHA-256:	843B636DE7B61E2079FA27298AFED15DDE4CED29F2B2CB1B8C092B6F6752879A
SHA-512:	B0C765B302A77841E8924A1625634187C5C35F62C98855D1FCD94D89FBD931663EC06C1795978D0CD4125FF067451879E9287C7621F20F5DA90F5D07D41F8818
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/destination?id=AW-1023673485&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-1023673485","tag_id":113},{"function":"__ogt_dma","priority":6,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":105},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstName

Chrome Cache Entry: 805

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 806

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45225)
Category:	downloaded
Size (bytes):	562934
Entropy (8bit):	5.54970436960453
Encrypted:	false
SSDEEP:	12288:FYvDi8KbEdCpakkxyb/Ox9HKaipPLG2k7FFuEkDU:bPLG2MuE7
MD5:	171E6A9A53F404B6932CAB417F84B867
SHA1:	377C49D5C707DBD4E6F5396649F9BDA92ABBE192
SHA-256:	0043EA3DE5C096B7E02B328E6E5BA85F4289F62172C66AADB9FF89E088E61646
SHA-512:	062C42BA67B7BAD90C6AB8DCC46BC6B57FDDBD155F8320ECDD3FC392918C05A00FF49741C9D8A9BDA89623F0E06A4383053BB644932C75F6FCF5832EC3AF6F1A
Malicious:	false
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-M5JB2B5
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"223",. . "macros":[{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"componentLayer1"},{"function":"__jsm","vtp_javascript":["template","(function(){var b=7;return function(a){a.set(\"dimension\"+b,a.get(\"clientId\"))}})();"]},{"function":"__jsm","vtp_javascript":["template","(function(){var a=new Date;a.setTime(a.getTime()+864E5);a=\"expires\\x3d\"+a.toUTCString();document.cookie=\"reimagined\\x3d1;\"+a+\";domain\\x3d.xero.com;path\\x3d\/;\";return!0})();"]},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__cvt_30923470_349","vtp_emailRedaction":true,"vtp_params":"username\|login_hint\|firstname\|FirstName\|lastname\|LastName\|surname\|PhoneNumber\|phone

Chrome Cache Entry: 807

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 808

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 809

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114672
Category:	downloaded
Size (bytes):	31409
Entropy (8bit):	7.990593558983198
Encrypted:	true
SSDEEP:	768:Ed2NyjCVk+0CCVdWWdA2D2EC6pgAvOYfhBlYBt7hX:kCDqWWK490GHaj
MD5:	60FE166092712D93CC87039640675EF6
SHA1:	D6FECA303438C5B9C717371E5492100FDF407EE4
SHA-256:	15982E98201BB48C59CE28BA7E5C2EAC42BD8C76F20AD4924BADDE014F2A4892
SHA-512:	E150F992F6C597398696D7C13A92262D712F5558386F51F5B9B8C1467B3B091F6C717F06C31BA5FAD86C3485B7B4A9DC0755871EECE9F13EF3987941BD84DC48
Malicious:	false
URL:	https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/main.js
Preview:	...........{...u'.U....p.@..&.CQ.E.IjHJ.u..U..n..P.W.....Z...8.d.n^.,.q..I..I...r.5..O}..-;..p..<.N..t7E....F.y..>.y^..../.N.A......I......O....w+..O..:p##....'G...........a...k9b.4...@/...4_.%.(<,.~....Q.F%...ab.z......K.Z.f^2... ...y..+ol^........~..+..fQ.P...0Jb.d6.....vu..~)..,Ku...J.../koo..G.XyfEVV....f.4..2g.....:.......`/.....rX..jy].2+...V...XQ.......$.:.7....h.'......q'\|X..1;.....x..^.../.7d.Y..~\:.uo<.X.S..e+x.........0....s.&......u.:e..]P=....sQ-a..&x....c"..9.....Q..>..?...d..@.Y.?^_.......s.W..U.OXt.=L..G.R..:..^.'oz...;.4.a.'..G-..:3...U..g.M^z.9'C..N..a..W./U7I...FM....gQI...X.s...?Vh.....Yu..+n....Ppl}P.YBC.W..G8.K....~x../.n..5k.....I.t.l=..x.B?....O.....;...... .j0..... c\M...7Ja.Da...i.;.K.....q.....#.F.C...0E..Dn.....:.....a8..Y.T.Xr.g....a.L&.Co...a.N&\....`.3....0+...].\|..".Z8C[..au....IrtW.`...R.x-...@&F......r.)M.%?.[A}.pY..P...Wt.....6:....B.....hy.I..z>...pm.2.P../Y.....W.......3.... ....p2%.

Chrome Cache Entry: 810

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 811

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	37840
Entropy (8bit):	7.985984138723152
Encrypted:	false
SSDEEP:	768:6iyEOkMIBOPyVNp0ig7T95O4O/2EcvXj+KiZAR3/6cH6nYf2GnPOELXKjb:6iyXhIBO6bp0igjONe9fN5Z/jYYe8POh
MD5:	EB1F603F66D3E9F08930A4EC3D5A4E59
SHA1:	BBB26CE9D92562E2CC7A43D0A88C72F48F9F2257
SHA-256:	04F62089B4C8A7A5401648D710F8BCCC9404074902381D135DF73F43E3748C15
SHA-512:	A2933EA8E63720F63DFE12D97A5773EF8DAAC10C0E25D57FC71A25B5BF998D57F1457F4BAFF2BFCC0CD097E32A29B8225AFC4D9944C66CFA7E8A20C65C49B98D
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/features/data-capture-with-hubdoc/2-up-wayfinding_wide_hubdoc-crop.1646877470313.png
Preview:	RIFF...WEBPVP8X..............ALPHv........f.e.f..S.NK`..7Z......Z..cvH.z..a...-.J...z.VN.P.z.`.?....v..?.....n.F...Mb..3-.$p.\|.....~....~....~....~....~....~....~....~....~....~....~....~....~....~....~....~.....(.BleQ..i.Xx..,/..[...!."K".V...i..ZY..F..c!u.N..hj..t.9..0..3.........U...<j.....%..,..W...q....o.@..M...y.....(-.mZ#..{..Hv.4.Be.2..(....1.e.~.....n+.e.....8....m.....+q~..4...a2K.a.DI..\|.V6....q%...,.?n.....V.R.n..y.;a...I..q.t.......V...v.2...y.*Y......t...Q]...kfsJ.....`"s.I...,..........k.qIC`>...ao%s...Ancl...L\|...i,.....T..zn........\..5\|N0..,0%.E.)G..L>I..Rio..U2...R.....$..p.s:.O"...\u.....vN.6..E.fW..2\.g5V.d.....u.g... .\|Bo..5.P.m.u`&....A5....1..J'.h{.{.k!.'....n.M..wV..+.yU..v....?.\..kf...h.$.)O.4.....Z.G4,..;.$J.....w../...$...............'.'.+W..I.1....D-.^....~XzO1.._.c../.K..yJ.-L.m..{.,..i...t..(yYV5X#...a...H..<.[xJ.....j..yG..51t....V....x...(R.v..W..E~.]..o...../3I.+.F....M..v.'.3...0^1M.,..

Chrome Cache Entry: 812

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 813

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 814

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=2, description=A florist prepares a bunch of flowers and checks their cash flow with Xero\342\200\231s retail accounting software., software=Adobe Photoshop 2022 Macintosh], baseline, precision 8, 1774x1420, components 3
Category:	dropped
Size (bytes):	170460
Entropy (8bit):	7.931593744802345
Encrypted:	false
SSDEEP:	3072:WPcXLa/vWsBWDBrOJS13sW2oG0PIYXaOBfz1Tlr5bNhao2XB/ZpPkth:GcbanW1aJS13r2cIYXa01TZ5bNYo6BpW
MD5:	8DAB5135ADC8709E3411DB5CDC45C8AB
SHA1:	51906534353DCF9773EE8C50BE36C247FDF831C3
SHA-256:	59A6043550DCEA667A54C16EB4943FEC3C55890762FBA868D1E510182872C549
SHA-512:	71862D7A52FA1711C6630C97080C1E6CE111F36BE0EE219C2D9F4F1AF9BCE2BDB3B1D845302A0148D7B530F8A34DD27BBFC517287BFDBFFF84401617CED4525D
Malicious:	false
Preview:	......Exif..II*.B.............1.......".......Adobe Photoshop 2022 Macintosh........k...`...1.......".......A florist prepares a bunch of flowers and checks their cash flow with Xero.s retail accounting software.......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164050, 2019/10/01-18:03:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:dam="http://www.day.com/dam/1.0" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:cq="http://www.day.com/jcr/cq/1.0" xmlns:Iptc4xmpCore="http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/" dam:Physicalheightininches="-1.0" dam:Physicalwidthininches="-1.0" dam:Fileformat="JPEG" dam:Progressive="no" dam:extracted="2022-01-24T12:17:32.038+13:00

Chrome Cache Entry: 815

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65441)
Category:	downloaded
Size (bytes):	947126
Entropy (8bit):	5.4290204215532665
Encrypted:	false
SSDEEP:	6144:5TaN/i5vlg1QSkDpMC7LIfamSi8VULGMyE48hWnnCGxOcXnMIusoT51zNjzDczdH:VacZlrL8Si86XpGIwoXNKA3QdWgR
MD5:	AC5D2DD78C2C706051D4EA4C996067E6
SHA1:	DE2BAA3F5D167696C2EF23022CB8E4F494587608
SHA-256:	7B105BBD4F52B5AB66D2C0745B07D532DA2CCBB201827DD5FAB66FBCFFFD6588
SHA-512:	F2F9EBD0A7873B98FADF8849544B09E5E8FAA5E893DB76125F7B21EB6B50C0D9AD11BD9FF355378D4EDEADFC1FA566173B3AFF9EA0EEE118621B4B27798C5721
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/IndexRoute.3ac4aebaaa085ad55ebc.chunk.js
Preview:	/! For license information please see IndexRoute.3ac4aebaaa085ad55ebc.chunk.js.LICENSE.txt /.(self.webpackChunkmy_bills=self.webpackChunkmy_bills\|\|[]).push([[952],{8009:(e,t)=>{"use strict";function r(e){return r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},r(e)}var n,a="https://js.stripe.com/v3",i=/^https:\/\/js\.stripe\.com\/v3\/?(\?.*)?$/,o=null,u=function(e){return null!==o\|\|(o=new Promise((function(t,r){if("undefined"!=typeof window&&"undefined"!=typeof document)if(window.Stripe,window.Stripe)t(window.Stripe);else try{var n=function(){for(var e=document.querySelectorAll('script[src^="'.concat(a,'"]')),t=0;t<e.length;t++){var r=e[t];if(i.test(r.src))return r}return null}();n&&e\|\|n\|\|(n=function(e){var t=e&&!e.advancedFraudSignals?"?advancedFraudSignals=false":"",r=document.createElement("script");r.src="".concat(a).concat(t);v

Chrome Cache Entry: 816

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27878), with no line terminators
Category:	downloaded
Size (bytes):	27878
Entropy (8bit):	5.47855986761635
Encrypted:	false
SSDEEP:	768:35C3C46nmGBRuVRuPArpu+TiUaPXM9uMPW1BKamb55GgFr+ILkLZiuDefWKjH6ic:R5nmGBRuVRuPArpu+TiUaPXM9uMPW7KE
MD5:	538BC8521EA5CAFCEB050579168EB232
SHA1:	5DEA89313A89AA9D67362E17A0B2E07247A8539F
SHA-256:	C63B42C8BFA3C682C648D0F26D20373CB994B1A80503D4CED076383452440D2D
SHA-512:	E97ED033FAB8797A702AD0C9F6099B08B2BE16A5AC7504D5A78542FCE8A7706A39BF3E94E0A95B0C7095A98EB6EB334FBEC33E8FB4B314DEFF8319DCB168C95B
Malicious:	false
URL:	https://edge.xero.com/business/mybills/production/360.862fcca8518a9068f07c.chunk.js
Preview:	(self.webpackChunkmy_bills=self.webpackChunkmy_bills\|\|[]).push([[360],{22926:function(e,t,n){!function(e,t){"use strict";function n(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function a(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?n(Object(a),!0).forEach((function(t){i(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):n(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function r(e){return r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},r(e)}function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumera

Chrome Cache Entry: 817

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 818

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151627872&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 819

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151658537&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 820

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 821

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (497)
Category:	downloaded
Size (bytes):	846
Entropy (8bit):	5.339176737942619
Encrypted:	false
SSDEEP:	24:si2N1V4NxwZG1pCSbjAjZ/s3eLSbjrjzs/jxyBSbjXY:rN3zEdU3eS/ELU
MD5:	F4349CD6DF2C5E3D1FFD048EF4062F17
SHA1:	9C4044DAD0E5AA829DCF0388F3470C4D21618385
SHA-256:	B7D6B599BB4E564E06295FCE33D175643F36F3C59DE0C7C071DF522D95EA0FE3
SHA-512:	D7A516B507555CAC9B7751022967510206AFEC9D549FE23AF5D7777D5F5F75A62E28FC4EA5D0158A188ED96A6A0E80A3E24DB95011F492981F89E0EE3FE49F11
Malicious:	false
URL:	https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals
Preview:	.<html>.<head>. <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script>.</head>.<body>. <div id="universalPixelContainer">. <script type="text/javascript">. (function(global) { . var ttdcm = new TTDCM(); . ttdcm.init( ["https://su.addthis.com/red/usync?pid=11124&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347&url=https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fgeneric%3fttd_pid%3daddthis","https://idpix.media6degrees.com/orbserv/hbpix?pixId=69060&pcv=78&ptid=87&tpuv=01&tpu=e09cd2aa-7185-40a5-bf74-4fc29b294347&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dyjn0gup","https://dmp.truoptik.com/6d78f32846d8648c/sync.gif?fck=e09cd2aa-7185-40a5-bf74-4fc29b294347"] );. })(this);. </script>. </div>.</body>.</html>

Chrome Cache Entry: 822

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 528370
Category:	downloaded
Size (bytes):	145072
Entropy (8bit):	7.997872437493743
Encrypted:	true
SSDEEP:	3072:H5YPbQetyORBPGMWv3uCfwcUMaat13aF8nE6+NQ:HYQIx6v3uCfW1hQ
MD5:	D8BF3AF29257E33695B238D38EC1FBA0
SHA1:	32C53F91F004E0FE480884E3DEEEC8B72604FB8F
SHA-256:	DF99DBA4E58104F8E3978F48BF4A4FDF0DF1D75860BA60563D0A6BEB3C7496AB
SHA-512:	4D3D4BF1C36E82E484EE2B25202FFC205ADB505559E8D6A9D7C551686E7E0E14DB04A6C08AF29B62A7223B8C5213A93F3D6DD50FBA7213BC7F53F67D10561F03
Malicious:	false
URL:	https://js.intercomcdn.com/frame-modern.e1eb984e.js
Preview:	............{.H. .W(^?]`..1)...V.l%+..^.$.",....4-..9...B...{w...7.2.P....0....S;(q...y.a~.q.^.WZ..S/x...>......^n.k.u.7=?r.N.......z....1.......F.o......F......L..6Pr.nR.Q...G..+.Fd....30V..7<.M...g.. ...\|`{0.............?....,.;.0.g....}...]...u./n:./n...,Z.~./.....<l....Q>..~.....`....w...3n.c?.....~..u.j...f....=..r.K..Q.b.J....{...6.MV.77..O=.o7..Y.R...B....Y.......g.....v..aK.....Fe.mm..A?.b...l.ZC.....~0RO.j...jV....v....j.=.n<.j..h.^.s..\j.[..^<.z..Ua.[..<.......ld`..\..l7.X=~..#...-. ^.j.^o.M.lz0..P..`..X.a...vms......jlW`5.[..I....J.m.j.s..7U..........\..8...{.....b....\|....X.zS...-mU.........T.......Q.....j.mV.....l.X.!....c...`.y?..j...U.....{..y...,....g.\|.l.g.b..hm..$..NS.)..cn4..v.)z..UiT.[[..-.7...^...mn.=.]...l.V.....n.....).0.&]4..#.M.`..vc..`...~4........m....o28.b%'..j...5..OcP...W.......p..<Y.-8...fM=.....&,q.p..,.NaX......\!:..!..#&%.N$l.;.I@..iG__w2..]...uz............X..j.4M...v.{.$M.Y...@.....a.'!/.Q...

Chrome Cache Entry: 823

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 824

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	2.716326985350135
Encrypted:	false
SSDEEP:	3:tQTltaL5UJjV9GjUJjVE:6XG5UJjGjUJj2
MD5:	8E3DB10AF5A3E1CABE7AA67674E21188
SHA1:	E2314B0038DF2D49DDBE461F33A6797D4586CDE0
SHA-256:	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362
SHA-512:	A4F136016F4591E021D54F06141896581371828BF02F662A050B2A36567DFEC6068A4C758815D481E01BD7D68692329B5EE228C854AB2D85246D05B56692FB09
Malicious:	false
Preview:	[71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Chrome Cache Entry: 825

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7711)
Category:	downloaded
Size (bytes):	300268
Entropy (8bit):	5.610624640854374
Encrypted:	false
SSDEEP:	6144:ak4IQX5NzJwYLceF+qKXjXP9RIMb65Y0aD:aNI+xJVNYD
MD5:	890B8DDE8B2E16365F7BFDF088163939
SHA1:	C644D6F7F04B21E0741D861CBE3995C497BF6382
SHA-256:	727965D769734D5D189B9C7826A1E896A305D84E37D6ACDA683B5D7ACEE9D60B
SHA-512:	254DF3A077DEF7D9D9EBEF393622D4A630FCA73EE31A895107166B15A990E66EE922C6A841A71990F3E0184B8DB21A260AC7DD19A51A90BDFC8B80ADCB67AE0D
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=G-Q622B96ZEQ&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":26,"vtp_rules":["list","^xeroblog2023\\.wpenginepowered\\.com$","xero\\.com"],"tag_id":111},{"function":"__ogt_1p_data_v2","priority":16,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_S

Chrome Cache Entry: 826

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 827

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (50463)
Category:	downloaded
Size (bytes):	205895
Entropy (8bit):	5.62877210528871
Encrypted:	false
SSDEEP:	6144:YnB3XrsBs9k0cyBxdcfxItyNc+LBsFNgYx4VO1/BLgIy5ZHWTMbubDqo++MiaQia:YB3XW2k0cyxd2c+LBsFNgYx4VO1/BLgm
MD5:	870273E71F0C6A721B98A212BE4A9F1E
SHA1:	7263A3F061CD54EBFD1E5F53CB06FF93F9092D43
SHA-256:	75BBFB08776BB2C8B784807A0FB5CD8CDAA414DE7424C02C995ED60F148A47E8
SHA-512:	D6FE3599C1AF6965D763EDA4DD0C9783712573B90BF3980F071043734433400ED060F34CEBC6E6C18CC4BE3359A7CEF6F606F4CD63E1CA0CC05BEF4CCB567503
Malicious:	false
URL:	https://www.xero.com/us/signup/
Preview:	<!DOCTYPE html><html lang="en"><head><meta name="viewport" content="width=device-width"/><meta charSet="utf-8"/><title>Sign up for free trial \| Xero US</title><link rel="shortcut icon" href="/content/dam/xero/pilot-images/admin/icons/favicon/favicon.ico"/><link rel="icon" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="114x114" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-114x114-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="72x72" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-72x72-precomposed.png"/><link rel="apple-touch-icon-precomposed" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-precomposed.png"/><link rel="

Chrome Cache Entry: 828

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	5.164156740774586
Encrypted:	false
SSDEEP:	3:RNIJhyCnaz/p97GR3CRNkavIyx5nkCwICkuWthHeTn:RUyCnaz/zvRNpvIS6C0kuqxeT
MD5:	74D8D639094DCDB91809FA903AE552AB
SHA1:	7F546111F2BEF7606FA1F455A5F119BF9DBAB644
SHA-256:	889B573ADEC8B8BCFF993B7948D7D9375DC902C52EFD4836BDF65CEA6337277D
SHA-512:	FE1B491CB680ACE0BCD4307E08DBFAA6C2834FF7A3974EB95CC5952A7375F1FCCA13ABFB6FBF6902FD8ECC6F2F9C959BFAA280A8931999144380783288EAB0E7
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISOgkga7g-ObYmIxIFDfyM-aUSBQ02_qTlEgUNfsTQghIFDf45w-ESBQ3q4WA2EgUNqCwxsRIFDVNaR8USEAmKMQoM0eXZnRIFDVNaR8U=?alt=proto
Preview:	ClQKCw38jPmlGgQIAxgBCgsNNv6k5RoECAUYAQoMDX7E0IIaBQiaARgCCgcN/jnD4RoACgsN6uFgNhoECA0YAQoLDagsMbEaBAgkGAEKBw1TWkfFGgAKCQoHDVNaR8UaAA==

Chrome Cache Entry: 829

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (631)
Category:	downloaded
Size (bytes):	517649
Entropy (8bit):	5.713376874006511
Encrypted:	false
SSDEEP:	6144:m1K1Z7NMxjW6eJoWvAlUjWwuMSYCVvLk8DSWd1Ps8Jz38iZc:m6eWTAujfuPY0JGgkt
MD5:	E2E79D6B927169D9E0E57E3BAECC0993
SHA1:	1299473950B2999BA0B7F39BD5E4A60EAFD1819D
SHA-256:	231336ED913A5EBD4445B85486E053CAF2B81CAB91318241375F3F7A245B6C6B
SHA-512:	D6A2ED7B19E54D1447EE9BBC684AF7101B48086945A938A5F9B6AE74ACE30B9A98CA83D3183814DD3CC40F251AB6433DC7F8B425F313EA9557B83E1C2E035DFF
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that contro

Chrome Cache Entry: 830

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.866602445362615
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAJ70MT6ZBAW8UZK3njWRZBAB
MD5:	9DFAC332BA53300DD79D5A6F96476423
SHA1:	524143EEA918B40E128EC00D93275251BB0AB618
SHA-256:	58DE1C15604E1D625AD854D74C6BC52D7EEDC99BD77D10A968771F88C9F8301C
SHA-512:	7C34DFA01CB406BC78BC955D41F91620F324BB27FE8612BCE0E66EDC19CD0B56B8C3F3180599990ACED864D4133BF7436530E11301B396E6CCA3240D679726DF
Malicious:	false
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 831

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:RFREYDA:jRLA
MD5:	A454F56F4DEF70095E30E7676718042E
SHA1:	DB6A025FAFED1D1AD75A6D8BBA133D473ECC58B0
SHA-256:	3DAE93A05EDD9DCFC1864B87178A31E0BFA93E1A9B1C486C6E9CBF73CAE87862
SHA-512:	70CDF04204F3D1DFFEAF7F925EEBF04EA720735625A3BE0375E4AAAF9030C062CE6CCE84607483B282D3F9DA3482E920F17C74E226961156B1612F64814E0365
Malicious:	false
URL:	https://tracking.g2crowd.com/attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/signup/&e=undefined
Preview:	// Tracking File

Chrome Cache Entry: 832

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (746), with no line terminators
Category:	downloaded
Size (bytes):	746
Entropy (8bit):	5.61103843456023
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEH8gUVNe4U/2egJn2Lt0DK0lTiUMGT2IWauqGsFsYBWhC:hMiRO9EUq4UBwk0x98G9PdDV
MD5:	670933EAF262A5C0487B1A73B476BF95
SHA1:	D1557CEDBAFC29552450BB3C38E860C2A026A519
SHA-256:	B6C23FF3956BC0F15AE785D3A0FDD5AF7E7D331447D0F4FB1BABC9C8AC207FDB
SHA-512:	D39AE1FE584E0D1BC8FDDE1E86A1847F6DE16CCBD3E8E11845942B4765560B0E4D7E7A9E3A22E6AD0912D5CBCD2AE76C323F5ED9B3888CFB93C959A374A1E0BE
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=*;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F"/></body></html>

Chrome Cache Entry: 833

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 14719
Category:	downloaded
Size (bytes):	3267
Entropy (8bit):	7.950430370795621
Encrypted:	false
SSDEEP:	48:XiIJFNMIi+LcjgxsFSQk2eabBmssT1o/dQlRUtjp0Hz+SUfyqzYJbbqoRdnG1zEc:SeNti+L5sFSFpo/m2wkwazEfn3yQ1ja
MD5:	2922A85CE6CAF46F828C097BF7AA1036
SHA1:	AFEDBAC8E6480A8C59CC6CA3359381731F75795B
SHA-256:	12D369C3D585D564678ED15F99B53DAD29FAA1E05475825CCD0E8F4C50CFB779
SHA-512:	F9AA3D6FA6CC032D050C1C995F5D274D4F0063101F7B428B81AC0C56F129FEC377987817F3245E32CC4B56D2F6379761BC64AC076514225E0B69108C87C6FA48
Malicious:	false
URL:	https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782
Preview:	...........[....~...........7A...W h...E?-(..y+K.H9.1..w...(..{-..%>.?..."}.._......O.Fn.O.../..0...<n..N...`...{7q......<.S)&N.&.%.4Iy......2f.~..!3........o.......u[!.....?..I.wDd4!4.b&I....Ix...d3#.9...-.,.fI2..i...H%#Y..%..sB.<M....a. >_..C. ...YL.(!lK.vMx".../D.A...[..D.?2.J.5........hN\|R.N.`..I..$.C...I.I.Y..+I..[.S.F..%!.....$O.".e...H\."sx 2$4.<..T..;$;...<...g!...`..U.CB..)..:O..%.I....I...&...=D....0p.0<=.Z.<%;.5..i.......x.a9.......f...+...4..<Y..!z..4....`1O.=.j6...)......b..)!8 +.8..a\|.........EY..@.2.e..E...\|.k.YD#.....R.....M&..Q.Sk]....8..`^..+@...5=...ny..M~f.!'....MHS....9..[.D..V&..K3..~)...W.....Zf.W.%]...4..E)1...Y.\..n....E.v.}.n.c`...\|.?.w?#.s.jV..xB.w.fJ.y......A=<............6^\..kp..q..)..0@91J.6...&..7.J.....M..T7..8t..9..+.^..?mY..j.I.u...@...S!=.....j(l......'_._....I.".qW..TZ.R....p?../.;...7<.Y....0f..J..%.,.O..}."\..VY8...H.B..L3U........b.[...._..=...7.Qy...&..Rky...ay...0`.J..4..@....74L.zSh

Chrome Cache Entry: 834

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151745111&i=gtm&dwt=2907&ive=blur
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 835

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	138
Entropy (8bit):	5.213278916391078
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHWbPun2GnNXC0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAWbm2GNS0MT6ZBAW8UZK3njW4
MD5:	7EBA7EB81FEE40CABB8596B910446C78
SHA1:	A2196C485B9F2D7BC6C6F3FD5F36DDFABB0C3302
SHA-256:	3580443E67004F0B66303521E9AF62BDF658E4DAEEB78207B4955D2A489E64EA
SHA-512:	40D4AC67E8B225396B3EA2392F2AF751F402F5BE0C706A094C990E8F9D0E4448F7AD7B5AB837E4964E22D54D38AEE3DD2B90563E6819FADFE560D2A9E7361708
Malicious:	false
Preview:	{"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 836

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	138
Entropy (8bit):	5.213278916391078
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHWbPun2GnNXC0MT6QMBWHW03UQM9o3JJjWRQMBWHjV:YGKY6ZBAWbm2GNS0MT6ZBAW8UZK3njW4
MD5:	7EBA7EB81FEE40CABB8596B910446C78
SHA1:	A2196C485B9F2D7BC6C6F3FD5F36DDFABB0C3302
SHA-256:	3580443E67004F0B66303521E9AF62BDF658E4DAEEB78207B4955D2A489E64EA
SHA-512:	40D4AC67E8B225396B3EA2392F2AF751F402F5BE0C706A094C990E8F9D0E4448F7AD7B5AB837E4964E22D54D38AEE3DD2B90563E6819FADFE560D2A9E7361708
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Chrome Cache Entry: 837

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 838

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A35%20GMT&n=-2d&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 839

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 840

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?
Preview:	<html></html>

Chrome Cache Entry: 841

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	3.9826031985455645
Encrypted:	false
SSDEEP:	3:qVvlKMD/WAGv4qgvOs+oNGb:qFMQ/H4lnoQb
MD5:	792E7DA69F9637E2F63C0FD5245DAC86
SHA1:	589F6FE5CE5EFBD111AC635C747838A84475CD6D
SHA-256:	F5FC14181849CB5F911A632A9663DD875BD7FA4A0565D05A17D8185CF643853C
SHA-512:	E78D9812F95CA53E1F591445AD731040F7A51107CBB411B533A36C7BC9534346DEE99FF6D3A5F948898B189471C01ECC68634DCD3CAB0B38E8EA077D56746C1D
Malicious:	false
URL:	https://s.company-target.com/s/sync?exc=lr
Preview:	<html>..<head>...<title>Pixels</title>..</head>..<body>....</body>.</html>

Chrome Cache Entry: 842

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 843

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1464x1464, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	44352
Entropy (8bit):	7.995064052020771
Encrypted:	true
SSDEEP:	768:8DAYbJfbAEtJJnXNeeGX5HFc7wDAtaDX+WTblCuj8P6ioqwRS32/jJCELLci8p8:YvxJ9eeGX5lcctX+WbguQobWACWcc
MD5:	08F9635A8CEDB189F7DAEA7A3DE612D1
SHA1:	1323A3FB5270975A20DE1A00E5331D3E9BEAF4B4
SHA-256:	EA775E4A3466697D8584895734B71159D7BFA69AB697B680DB13FA044D43ADE9
SHA-512:	2AFC7D3AFAFCCE1A00842ACED7BC4E2B1D50CBF392DC87CF94816A3E626F47EFD765D26708FC0E96C9C89AA581329E2B3FC09A9F61EF50C27C6631A84FB77137
Malicious:	false
URL:	https://www.xero.com/content/dam/xero/pilot-images/features/invoicing/Invoicing_hero.1646877463310.jpg
Preview:	RIFF8...WEBPVP8 ,...p........>.v.T.......zp..cn.i.n......xe..W....~G.....Q.........y.........'...d?..{....^.I.......Q...o.....o.bm/._...SN....Z......M..@..}..U...}.e....o9.[..=.=?.yz..y.y._.....g.........y.\|....w4y..t..U....#..L......=.{.`..1.b..z7.$%.-.c..1.c.....U.s.v)...u.2...\|n.:,./.1..P..%XG....+..0o..5.....!..;.6.F..YY...w.[Q.p......8....bk?.@.c..yn-....8../$.....S:e....q!R..0......>Q..%.R..J.F. \. >.z>....;.>.8...QB.......j.=..c\&.....r..^..N.a.H...ct..:.h..1...K.5\..t..I.....hm.....R.jvi.....$]......"....r.w.....o...S?.vqY..J......N...\?Z.XgF..q..v.y..+2=..aC$ H,$.[...Kx...Y...]..i.k...{...D7(..)F....Q.O.1;...3.;x{..w.X.i.....G......#.y..t.s0....C.o...gc...2r.i./.....4.m.c. ..3Qr..Ox;..+.j.U.E;{m,.e..Tct..v(e.<....X.4=....6S.;?...0.`...)7..^;....=.%.O$.j.."....s...j:..VBY..9...)...BS)Uw.}....%.P...A.%...A......807fa.....*]=.'.:....8F..QR..J...B.=....{.uY.../I._.1...LL^>..TO....w....&.<.._Q..r0.:....8J3.....].....S......

Chrome Cache Entry: 844

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347&google_gid=CAESEHFXfyZ9kVq0mrodDvvN5-s&google_cver=1
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 845

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.19215926745789
Encrypted:	false
SSDEEP:	3:YGKy++6QMBWHjt0C0MT6QMBWHjzlRQMBWHjV:YGKY6ZBAJ70MT6ZBA9RZBAB
MD5:	2D12C1129F6FF37622D03DB4A2A5949E
SHA1:	BC44653C4A06E671CE423600755FED86FAD8EC24
SHA-256:	078F3DD88E751C3C421B2007E1CB27BCB65A95DAF278BD25DE81BA7B2BF3C4E4
SHA-512:	420AFB8CEB53E68C593A1242DB304C4F551C23A3C181B4D4EEBD2B74E3EB9740C803C182FFB646AF57D2E778E9D802D8A44E5C0CB9FF11FA272D1E9C0F2B0D36
Malicious:	false
URL:	https://tags.srv.stackadapt.com/saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90d5d4d008ed05bc342b1703ab2f94757668198dc&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY
Preview:	{"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Chrome Cache Entry: 846

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 847

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32010)
Category:	downloaded
Size (bytes):	50049
Entropy (8bit):	5.315307632257224
Encrypted:	false
SSDEEP:	768:PFFeY2oE4e2HneiJbpJuAl39FVy7bT0tUpFk8Qgm:tIyreiBphl39FsvTpFvi
MD5:	63E2DF852D15AB21D7FF8FC4363222E8
SHA1:	7EE401BA652DB0A4EC960350E17216CDA01E22FB
SHA-256:	545156ADEAE44DADC82B98D504F805EBE77FB79C928EF34EED1057BB9D4CB8FE
SHA-512:	BAAD17C762461527B270B57EF294E28BEFF92B3A66829B8DDD8788A791AEBB0A40BE849BFC79FCFC5CB0D7FFC7FD709CA6CD6A61CAC878CE60F585D40F214970
Malicious:	false
URL:	https://js-agent.newrelic.com/nr-spa-1216.min.js
Preview:	!function(t,n,e){function r(e,o){if(!n[e]){if(!t[e]){var a="function"==typeof __nr_require&&__nr_require;if(!o&&a)return a(e,!0);if(i)return i(e,!0);throw new Error("Cannot find module '"+e+"'")}var s=n[e]={exports:{}};t[e][0].call(s.exports,function(n){var i=t[e][1][n];return r(i\|\|n)},s,s.exports)}return n[e].exports}for(var i="function"==typeof __nr_require&&__nr_require,o=0;o<e.length;o++)r(e[o]);return r}({1:[function(t,n,e){var r=t(46);n.exports=function(t,n){return"addEventListener"in window?window.addEventListener(t,n,r(!1)):"attachEvent"in window?window.attachEvent("on"+t,n):void 0}},{}],2:[function(t,n,e){function r(t,n,e,r){var i=d(t,n,e);return i.stats=a(r,i.stats),i}function i(t,n,e,r,i){var a=d(t,n,e,i);return a.metrics=o(r,a.metrics),a}function o(t,n){return n\|\|(n={count:0}),n.count+=1,v(t,function(t,e){n[t]=a(e,n[t])}),n}function a(t,n){return null==t?s(n):n?(n.c\|\|(n=f(n.t)),n.c+=1,n.t+=t,n.sos+=t*t,t>n.max&&(n.max=t),t<n.min&&(n.min=t),n):{t:t}}function s(t){return t?t.

Chrome Cache Entry: 848

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 849

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 850

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2671
Entropy (8bit):	5.132766049498624
Encrypted:	false
SSDEEP:	48:Yt+PjCHcw2tGU1ap7AiG3VucK/oroup3xNBT2tVWERVOoOaV8mVOgVyEyCy7yHyB:I6oftU1apzSVurEebkta1B0vpOShUO
MD5:	0A3C6F11D41D704ED55A49CFB964ABD6
SHA1:	DA6416290DC8F56BACA37549C454901AD968CCA8
SHA-256:	EBADE59C9C8E300E7073D58BE7197DEB3511E99693AFFFE3F39D6AE4A7C6183B
SHA-512:	CD4E002223B03AA19EF8B5B6D115559069F1B0095ECB7126B4336E10468BF40AC030B474F70BE9F4114E332AD40AAA51825200501DBB43720B61A246942CA4DF
Malicious:	false
URL:	https://in.xero.com/api/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1/getDocument
Preview:	{"status":"PAID","organisationId":"c0f47435-9703-4d0c-ac52-bdca2d164dcb","orgLegalName":"Lizzie Solutions","orgName":"Lizzie Solutions","organisationAddress":"Contact Helpdesk at: +1 (802) 277-0178 / +1 (802) 659-4471.","orgCountryCode":"US","documentType":"INVOICE","documentTitle":"INVOICE","isPdfPreview":false,"isX4XDocument":false,"isRepeatingDocument":false,"showLogo":true,"logoAlignment":"Right","contact":{"id":"2b306440-8595-4bea-9ecc-5cfcee9f8f87","name":"User","emailAddress":"Confirmation@WilliamsSolutions615.onmicrosoft.com","address":""},"documentNumber":"56576","dateString":"2024-04-26","expiryDateString":"2024-04-26","showLineItemsHeaders":true,"taxUnitName":"Tax","lineItems":[{"description":"Purchase of 0.0098469142 Bitcoin.","unitAmount":631.1800,"lineAmount":631.18,"quantity":1.0000,"taxAmount":"Tax Exempt"}],"taxLines":[{"id":"TOTAL","taxString":"Tax","lineAmount":0.0}],"deductionLines":[{"id":"DEDUCTION_PAYMENT","taxRate":0.0,"lineAmount":631.18}],"subTotal":631.18,"am

Chrome Cache Entry: 851

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.3363671951593865
Encrypted:	false
SSDEEP:	3:YWMmqehTSZ4JtZlCn:YWMm9gZ4Jt6
MD5:	427030F29C7B0DB89D0DC8062344BE31
SHA1:	9399D02456632C4510B2F34F9F99CDB999121222
SHA-256:	388D44F383FD1E564BB7E4AB095EAE911F54634DFD70C675D06A5A3E8C623CD6
SHA-512:	15B5DAD109E4282E9462E570076BDAF640C2206BC4645CE2D65D4662495748F7BF003BC3661C2ED3DF88D32BECC46B80499745F4271429AC4C6D9A24010BE979
Malicious:	false
Preview:	{"site_domain":"arlid:534172","rate_limited":true}.

Chrome Cache Entry: 852

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (30984), with no line terminators
Category:	dropped
Size (bytes):	30993
Entropy (8bit):	5.0011860238398675
Encrypted:	false
SSDEEP:	384:18x2ZB919XDLWT2LTzBX5C3pLH3pYEp+5y/tN0301DvG:qQB919XDL3JX5K3mED5lvG
MD5:	C84C22D7F7834797B0DEC8DAD2F0798C
SHA1:	C1A61534778B4BE259E81F0B30551284990F813E
SHA-256:	D52D7D1D16976A64176872FF784A0EA7BDC8EFB3782EB6D2A9927288FB8ED645
SHA-512:	FC4C6D11F6455DE3E961BDD3214DC19CE297ECCB8618B88C4A606D147EA36B31D5B0E7E38226AE3D010802E136C59FD130B74B03547D5CF514044AA9C50CC09A
Malicious:	false
Preview:	{"pageProps":{"header":[{"heading":"60% off for 4 months when you purchase Xero. ","@type":"xero/components/content/offer-banner","@oldId":"content-offer_banner-1115512261","alwaysVisible":false,"link":{"current":false,"text":"Buy now","href":"https://www.xero.com/us/pricing-plans/","leadingText":null},"promocode":"SPRINGSAVE60","theme":"human","id":"SPRINGSAVE60","@id":"content--1734539736"},{"buttonText":"Change region","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","regions":[{"name":"Global","code":"zz","href":"/"},{"name":"Hong Kong","code":"hk","href":"/hk/"},{"name":"South Africa","code":"za","href":"/za/"},{"name":"Malaysia","code":"my","href":"/my/"},{"name":"New Zealand","code":"nz","href":"/nz/"},{"name":"Australia","code":"au","href":"/au/"},{"name":"Singapore","code":"sg","href":"/sg/"},{"name":"Philippines","code":"ph","href":"/ph/"},{"name":"United Kingdom","code":"uk","href":"/uk/"},{"n

Chrome Cache Entry: 853

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 854

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<html></html>

Chrome Cache Entry: 855

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (709), with no line terminators
Category:	downloaded
Size (bytes):	709
Entropy (8bit):	5.628679131595798
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHeG+XVNe4Usre7M1n2jcmQTiUMGT2IWauKfYtahC:hMiRO9iwq4Usre7MZicN8G9P92
MD5:	00AD3987859287F5A126432E82F9191C
SHA1:	2A8C4A420512A7571B6B0EB4AF0C5DD234A66F8D
SHA-256:	A3AF4E7FA1CA459D1A7B2BEF9AC5EE39DE35BA488DA0ED6BA302408FA9AED127
SHA-512:	896720B89F3A98423877A618E6C2C9D04B7D346586FEE1A6EB734814AA51B5F3F43E85CCE06CC9254848506F564F80C57E56F43A4F8514705D0616C57A878AEB
Malicious:	false
URL:	https://9401320.fls.doubleclick.net/activityi;dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=*;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F"/></body></html>

Chrome Cache Entry: 856

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (487)
Category:	downloaded
Size (bytes):	488
Entropy (8bit):	4.841686487844174
Encrypted:	false
SSDEEP:	12:ZorFgHDWrwAfu1eEkLsFtdJdG8nGELUD4LxZr8a65wARn:pDWJfurG8Goa4UR
MD5:	2775054C068B37509E0798448F7FD32C
SHA1:	8CCB907373C30EB3B98D5A24EC92141A938F09F5
SHA-256:	484EF4268F1D679C1AE88C06FC2388D39AFC441465732617E5E2CDC2E3D418E2
SHA-512:	5423F06453EA452614E21391C098D252DDB65ABC958C02664D9B6F1BD3BAD858B396B053C57AA714391C8953F849FAC3B6ECB9AA0C4F74F4FB81C1242B485EB4
Malicious:	false
URL:	https://js.adsrvr.org/universal_pixel.1.1.0.js
Preview:	var TTDCM = function () { function n(t) { var e = "iframe_" + this.mapIndex++, i = document.createElement("iframe"); i.setAttribute("id", e), i.setAttribute("allowTransparency", !0), i.setAttribute("height", 0), i.setAttribute("width", 0), i.setAttribute("src", t), document.body.appendChild(i) } this.init = function (t) { if (this.sslOnly = "https:" == location.protocol, void 0 !== t && null != t && 0 != t.length) for (var e = t.length, i = this.mapIndex = 0; i < e; i++)n(t[i]) } };.

Chrome Cache Entry: 857

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?
Preview:	<html></html>

Chrome Cache Entry: 858

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2883), with no line terminators
Category:	downloaded
Size (bytes):	2883
Entropy (8bit):	5.950066520016371
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08TE4vec8pQwzW+2G9A4i+nP:wsbSUtJfxrqLWWWdV6j1vE4mc8poD4ZP
MD5:	A81CDAB7F57003C2E85BBB582D807362
SHA1:	92A9949A97F77BE50CA8BA306E6C451C9EA91B8D
SHA-256:	E7DFC8C2AF125FF6BDBE84BA9B1242B70C76D32D449C1BD276481CCF7C362364
SHA-512:	D23DB06727AADCD2DA5D873ED558E38F00A3C39CA82F1F46DAFBEB584765C9C002A6FD9E5FE22A91E5A1AB2CD7E9242127E85089D793E4AADF296B2C62EF8A91
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/1023673485/?random=1714151696676&cv=11&fst=1714151696676&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 859

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	658
Entropy (8bit):	4.362309726226205
Encrypted:	false
SSDEEP:	12:YWTL36JOfl1MlxKfw7I33xdfEsd6YWu7kTdgplw78fd8a/v6jUK8gPDjaL:Yi6JlcwsdcDerSLaL
MD5:	289BCB620B5FB3B5ADD262CA01820813
SHA1:	193D8ADC1B0041441AE4800ADDD2F2C0120EA3B6
SHA-256:	6D9347FDD5DDD690198DDF4EC3E04EDED6FB583E26C02A5C3E034D2C4DB67CED
SHA-512:	52EFD7C2239A4DC01954A8CBCE7C61F74CC69269FDBBAAC945E5D505383A100D7B77AAAA2487B78C73964D1C5966B5FB91DEE9E51B144B6F722DCB78A04BF519
Malicious:	false
URL:	https://user-tracking-api.dgt-digital-marketing.xero.com/query?client_id=GA1.1.1035819485.1714151589
Preview:	{"user_id": "New", "exclude_flag": false, "is_demo_training_or_test_org": false, "is_xero_staff_org": false, "spam_org_name": false, "spam_or_xero_org_flag": false, "no_sign_up_spam_email": false, "no_sign_up_education_sign_up": false, "no_sign_up_competitor_domain": false, "no_sign_up_xero_staff_sign_up": false, "no_sign_up_is_spam_name": false, "no_sign_up_user_has_been_disabled": false, "more_than_2_orgs_in_a_day": false, "spam_email": false, "education_sign_up": false, "competitor_domain": false, "xero_staff_sign_up": false, "is_spam_name": false, "is_online_invoicing_invite": false, "is_education_user_by_promo_code": false, "is_api_user": false}

Chrome Cache Entry: 860

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Chrome Cache Entry: 861

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (519)
Category:	downloaded
Size (bytes):	868
Entropy (8bit):	5.345517276056336
Encrypted:	false
SSDEEP:	24:si2N1V4NxwZG1AYIMNxGSbjwQSbjOjzQDSbjfm7Y:rN3yINREty461
MD5:	C6DAD434E169E2CB66A8D679A40E1605
SHA1:	06AB1044C371B391482066E7D0A6E50C27EF89B7
SHA-256:	AD1C40C4948A849C4EF0A4B758DDA9FC1851F10C347DBC80314C239A70CCAE6D
SHA-512:	B1A0AD0B181711E1E7283A9060CDD6A7C26D86B56DBCCAB62B804113C48D40E4E02A327374C339038F7317589F5425DC9F7E668D2B1221AEF1A0714164B0B7C9
Malicious:	false
URL:	https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/
Preview:	.<html>.<head>. <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script>.</head>.<body>. <div id="universalPixelContainer">. <script type="text/javascript">. (function(global) { . var ttdcm = new TTDCM(); . ttdcm.init( ["https://mid.rkdms.com/bct?pid=211f5e71-10d4-4933-8c11-c9798f096adc&_ct=img&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347","https://ml314.com/utsync.ashx?eid=53819&et=0&fp=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dd0tro1j","https://eb2.3lift.com/xuid?mid=3658&xuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&dongle=0cfd&gdpr=0&gdpr_consent=&redir=https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50"] );. })(this);. </script>. </div>.</body>.</html>

Chrome Cache Entry: 862

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 632 x 328, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292134
Entropy (8bit):	7.989083807796007
Encrypted:	false
SSDEEP:	6144:jZshDKg2BCr0DsVsxoiUr4jfMNZc6Cscrjxjl8u04dS78l1oQjAVoenDs:dsgo3cjsTchBdS4l1oQjAC
MD5:	77EDDFDB3AC055CD746A90A7F8D2D442
SHA1:	EF585D669BB94CAABBE6587BDD7EB304B097ECC5
SHA-256:	26FF0FE6662F2FE50073E8816DA341F3B776C5D2A8BF0BC8B5ADE56C95961427
SHA-512:	39F4C2DFCDCC6666502A64BC1C694F03BAD09C7C16B80F0135FABA83629E71853BE4C0C0D9E3C35FEACC9CFE8CFCDB268946C3F23E92E3F838401F53B26CE65E
Malicious:	false
Preview:	.PNG........IHDR...x...H.............sRGB...,.....pHYs...............t.IDATx...xVg..=s..R..!B.C...C...!... .I .M.......B..J.B.t.y.{.9/..^....sd...J....z\|?y....^._...d.I&.d.I&.d.I&.d.I&.d.I&.d...rv66...2D...`.....AOs....Bk...n......-l].`..x.=(a..GP.....??..:.7H&.d.I&.d......a}==...m....T..;d.t....g..}.8.9..E.v4l.l`hh.S.3...! s..}.....{P.....}G'.6.$.L2.$.L.....T.......dbd..G...h....U[MU...r....b.%.......B..`.......6`...L.......x...k...,O...C%.L2........N..P8y....vg.=.I&.d.P.0@mB........xm.....t(..,.9.9}]=.../L@]../.\.`in.77o.....;O...@..?8...k......x{..ut..ru....W........p..Wq..5i?..u..(.e....&.^ryR..f&%.56..t.I&.d...M.....[/.....<v:.j..........1...:...0.D....6..z....Fxp.b.......&....Bt\*..B`b`.oOo..gM...'$.`...........<<.z;...8.F.Y..Y.:.....Bm..^.z<....4zu..p`..w...].....o.j.A......:.7H...?.....y.X...\$.."-=......?N2.$...l&...=z..f@.....aO...5.]\.d..#=..........{.{...1.......<y~^>...Gdx$.ut..........<].g...W......S..=&........I.n[@@@O.. +G......!~~..l

Chrome Cache Entry: 863

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 705897
Category:	downloaded
Size (bytes):	166299
Entropy (8bit):	7.99719957204128
Encrypted:	true
SSDEEP:	3072:0C644QTQb2yL3KI7lOrBy8sJwssBSG+2axG5octgBkzFPnjm82bWkrArFBDbgWjh:0mm26f74DsJdsBSh24cKqnjm8urQDbV3
MD5:	D625DB79DB383FDAEF04243566C4AFCE
SHA1:	602DD72D8ACE3CAF67935FADFA7DBB2F8124AC80
SHA-256:	7F3046C46346778BB29417C58A123A51E6B192997660E5AA4315B84D5ECBC5C6
SHA-512:	50B47A9E4605FDEDDF18D54BA7B01EDB8797EEF02F480475CABF8665908D7669440708CAD92DC6BB4E34924EC613BD630668D9BFBE2780CA17233024F248E2CE
Malicious:	false
URL:	https://js.intercomcdn.com/vendors~app~tooltips-modern.7e0e68e9.js
Preview:	............s.G./....../......6(H..)K6..D.n..N.(.e.(.P E............S.e[^..v..^...\|x......B..<=..>..k.U.Y...<..df.N..k........G..,Qrs. z.....$..G....(....z.C.E.,x}.n..K..W.x...kq...Ro\M.u/%N~$G.......39WZ.....3..#.j..+xd^r...\|..:Ka..8..c~.....g.Z..v....lf.Xe...c..).%.!...8.Y.>N...XdI..(...8.cf...S....z..ror.D....'J.$[..Yf!...A.>..y..j.<..G>\|d.-V....z....l<.G.K..,.`G...Ex..sg..h?N..v.{....g....$zyI..~.22x.M..w.&+....S.E.+..y.Y.../..B..[of..j...gT<.Y...7..K......{\..sH.W.tr2W...b...*.OG..9=?.b.......H4....B..$.......t.<.....kx}......3......R.]{...V....c..F;D..I..T...).d5.6=L4v..e.~...<..c.5N-..)>4_z.....e7sv...I...9x.d5.,zL..C...hSu.f...%..9.t.x.,X.,.PQOXE.Z(.6[..&W$....v5.?N.8.G........K..Ef............1.X........j.)..O6;,....\...^;..?...S.%.OM.z............d.<./CI.f.DG...9)...0...1=.&\|........=.T.%qn..1-)-...q.....w..uy....L......".e...v.fFJj..[i..n%......e..WsxG.-.l.0...... ..w!T.D..'..!...N.d..[N[)yW.>Yt..:....\|...>.......&.Y_=

Chrome Cache Entry: 864

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 865

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1763)
Category:	downloaded
Size (bytes):	199517
Entropy (8bit):	5.527502415113866
Encrypted:	false
SSDEEP:	3072:LUQaf5qZ3fhO+ATcE8NG1LceF2/ea8LR9Wk9ARCzOQjSTnXDL9btIMPuuL:IQX5NAQYLceF+scTnXP9RIM2Y
MD5:	B9DB866BAE5A4AE3004ED6A00988E676
SHA1:	E9C1AF560F962A75DC9339DB7DF7F42840C9B671
SHA-256:	7C0F8207A03A827F6B38387CF5E73C01E10FC5BC65286941958188ECB39FD647
SHA-512:	B1F09217D24A47BCE832E07A0267D65BDCCB427B9C273D6B90E67183994B9AD88BB5A15444A31C568C36D77FF1D12D070497E0AE14439CA5B6EF7EA7AA86891C
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/destination?id=DC-940320&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}...}....,"security_groups":{."google":[."__cid"..]...}....};...var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},fa=function(a){for(var b=["object"==typeof globalThis

Chrome Cache Entry: 866

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 867

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (532)
Category:	downloaded
Size (bytes):	3899
Entropy (8bit):	5.14595235857322
Encrypted:	false
SSDEEP:	96:r6jI8+c01yY6QwFEPmXy3+UvKJygLmM62yANtKh:OHKMEwuPymKggr2
MD5:	6EAFACFE7D21F1B942A0D5E1D14679AC
SHA1:	D6FC6CCDC3CD35A6FEF71E951DB2CC85662AE817
SHA-256:	933D2E00A1738AD482B66A4FC741299A3CEF9A2F13B11A30B277BC51E5D57019
SHA-512:	281B603E6D5262AA538C6CB34FA9E97BE345D88C3C3CFCE0B7573EBA3F69F705B29644FB73DEF94FD87808C03E86A87DF388A6BA52F5405A01CBEDBB8B4B226B
Malicious:	false
URL:	https://rules.quantcount.com/rules-p-W92Yh-Yvb160e.js
Preview:	/. Quantcast measurement tag. Copyright (c) 2008-2022, Quantcast Corp../.'use strict';(function(a,k,h){var l=function(d){var e=h.createElement("a");e.href=d;return e},m=[/^http[s]?:\/\/((adservice.google.)\|([^\/]fls\.doubleclick\.net))\/.~oref=(?<url>[^;\n])/,/^http[s]?:\/\/[^\/]tealium.\/.page_url=(?<url>[^&])/],n=function(){if(k.top!==k.self){try{for(var d=0;d<m.length;d++){var e=h.location.href.match(m[d]);if(e&&e.groups.url){var f=decodeURIComponent(e.groups.url);break}}}catch(g){}return f?l(f):l(h.referrer)}return h.location},p=function(d,e,f){return d?"nc"===.d?!e\|\|!f\|\|0>e.indexOf(f):"eq"===d?e===f:"sw"===d?0===e.indexOf(f):"ew"===d?(d=e.length-f.length,e=e.lastIndexOf(f,d),-1!==e&&e===d):"c"===d?0<=e.indexOf(f):!1:!1},c=function(d,e,f){var g=n().href;p(e,g,f)?d(g):d(!1)},b=function(d){return"array"==={}.toString.call(d).match(/\s([a-zA-Z]+)/)[1].toLowerCase()?{labels:d.join(",")}:{labels:""+d}};try{__qc("defaults",a,{labels:"_fp.event.Default"})}catch(d){}__qc.apply(nu

Chrome Cache Entry: 868

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&et=custom&ea=purchasestage&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 869

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://alb.reddit.com/rp.gif?ts=1714151658542&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc=
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 870

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (50463)
Category:	downloaded
Size (bytes):	238479
Entropy (8bit):	5.695526176046746
Encrypted:	false
SSDEEP:	3072:QB3XrsBs9560cyBxdcfxIt3XLGhGtxnIOBZp:QB3XrsBs9k0cyBxdcfxIt3XLGMthp
MD5:	CE6473B0EFBEE26C28AAD595854BF7AE
SHA1:	975C2FD36641B71F992A7A9E94FC7FAD0C6F5AC0
SHA-256:	308F510FE7E33D98A794EA59723D9B42AAE8FF49957907A44AF7A2AACDD2208A
SHA-512:	DDBB2BEBC6A85FDB4E53EF2F1E21CB0C5FA68B111762677075847AB1AC3EDB7BF3DD024A91FB672C835172EC25B1B410455595CAF6B1DF163EB7220F9C193AF8
Malicious:	false
URL:	https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals
Preview:	<!DOCTYPE html><html lang="en"><head><meta name="viewport" content="width=device-width"/><meta charSet="utf-8"/><title>Manage Invoices with Xero Accounting Software \| Xero US</title><link rel="shortcut icon" href="/content/dam/xero/pilot-images/admin/icons/favicon/favicon.ico"/><link rel="icon" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="144x144" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-144x144-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="114x114" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-114x114-precomposed.png"/><link rel="apple-touch-icon-precomposed" sizes="72x72" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-72x72-precomposed.png"/><link rel="apple-touch-icon-precomposed" href="/content/dam/xero/pilot-images/admin/icons/favicon/apple-touch-icon-precom

Chrome Cache Entry: 871

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A11%20GMT&n=-2d&b=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 872

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Preview:	GIF89a.......,..........

Static File Info

General

File type:	PDF document, version 1.7, 0 pages (zip deflate encoded)
Entropy (8bit):	7.230745481575516
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Activity Statement for User 01Apr2024-30Apr2024.pdf
File size:	45'057 bytes
MD5:	c35188fe30d1402ed3a95fd86e390d0e
SHA1:	b618d5ca0a2d7377c5f38cab054d56bc5818cbd5
SHA256:	49609a661ee7158464594fbf75ed0b8a9d3c828556eb8a492d9afaa3c5b2c770
SHA512:	af0805c809b7cee78feb3f5822b58162edd5efee57eaa48418b1705c3252242117ecb2b8a9098921aaa1fba7e11215eeb811482937b55a6f709603cb97ff5b5c
SSDEEP:	768:8Cxdxqqq4uR0VfDk5LK4gMfnRCIxMR0yDhL4pxRXYiIHwxCDdC5rsIVD0gk12M:PlWG4gMzO0UREXYiI5JIsIVAgA2M
TLSH:	5313AFC9E2AA9E1CEC61DEB4B51A7A4490EDF183C7CF81B771C8498594C05BCBCE05D5
File Content Preview:	%PDF-1.7.%........1 0 obj.<</Version/1.7/Names 8 0 R/Outlines 2 0 R/Pages 3 0 R/Type/Catalog/Metadata 26 0 R>>.endobj.2 0 obj.<</Type/Outlines/Count 0>>.endobj.3 0 obj.<</Type/Pages/Count 1/Kids[9 0 R]>>.endobj.4 0 obj.<</ModDate(D:20240426150322+00'00)/A

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.7
Total Entropy:	7.230745
Total Bytes:	45057
Stream Entropy:	7.191885
Stream Bytes:	41413
Entropy outside Streams:	5.270813
Bytes outside Streams:	3644
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	25
endobj	25
stream	9
endstream	9
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
23	0000000000000000	86f503cfbec4522fdaee3a3c4227b799
25	0000000000000000	9a07d0fa97e0eaed4841cc047b32275e

Network Behavior

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 19:12:34.635870934 CEST	192.168.2.5	1.1.1.1	0x37f7	Standard query (0)	in.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:34.636008978 CEST	192.168.2.5	1.1.1.1	0x9615	Standard query (0)	in.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:37.859447002 CEST	192.168.2.5	1.1.1.1	0xb89c	Standard query (0)	edge.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:37.859607935 CEST	192.168.2.5	1.1.1.1	0x73aa	Standard query (0)	edge.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:39.134217024 CEST	192.168.2.5	1.1.1.1	0xa184	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:39.134402037 CEST	192.168.2.5	1.1.1.1	0xf3ff	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:41.892761946 CEST	192.168.2.5	1.1.1.1	0xf5d2	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:41.893254995 CEST	192.168.2.5	1.1.1.1	0x9e02	Standard query (0)	js-agent.newrelic.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:42.442884922 CEST	192.168.2.5	1.1.1.1	0x2ae2	Standard query (0)	edge.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:42.443046093 CEST	192.168.2.5	1.1.1.1	0x65ac	Standard query (0)	edge.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:42.714849949 CEST	192.168.2.5	1.1.1.1	0xf394	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:42.715066910 CEST	192.168.2.5	1.1.1.1	0x292c	Standard query (0)	bam.nr-data.net	65	IN (0x0001)	false
Apr 26, 2024 19:12:45.887123108 CEST	192.168.2.5	1.1.1.1	0x267d	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:45.887271881 CEST	192.168.2.5	1.1.1.1	0xfb0f	Standard query (0)	bam.nr-data.net	65	IN (0x0001)	false
Apr 26, 2024 19:12:45.902756929 CEST	192.168.2.5	1.1.1.1	0xb85c	Standard query (0)	in.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:45.902888060 CEST	192.168.2.5	1.1.1.1	0xeb6a	Standard query (0)	in.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:47.184685946 CEST	192.168.2.5	1.1.1.1	0x7ccc	Standard query (0)	product-analytics-bff.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:47.184854031 CEST	192.168.2.5	1.1.1.1	0xf0d5	Standard query (0)	product-analytics-bff.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:47.798253059 CEST	192.168.2.5	1.1.1.1	0xf61	Standard query (0)	widget.intercom.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:47.798398018 CEST	192.168.2.5	1.1.1.1	0x4dc3	Standard query (0)	widget.intercom.io	65	IN (0x0001)	false
Apr 26, 2024 19:12:49.976063013 CEST	192.168.2.5	1.1.1.1	0xc410	Standard query (0)	js.intercomcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:49.976246119 CEST	192.168.2.5	1.1.1.1	0x61c8	Standard query (0)	js.intercomcdn.com	65	IN (0x0001)	false
Apr 26, 2024 19:12:51.148442984 CEST	192.168.2.5	1.1.1.1	0x348a	Standard query (0)	api-iam.intercom.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.148772001 CEST	192.168.2.5	1.1.1.1	0x1f30	Standard query (0)	api-iam.intercom.io	65	IN (0x0001)	false
Apr 26, 2024 19:12:53.677704096 CEST	192.168.2.5	1.1.1.1	0x1f56	Standard query (0)	nexus-websocket-a.intercom.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:53.677926064 CEST	192.168.2.5	1.1.1.1	0xb608	Standard query (0)	nexus-websocket-a.intercom.io	65	IN (0x0001)	false
Apr 26, 2024 19:12:55.212444067 CEST	192.168.2.5	1.1.1.1	0xc6de	Standard query (0)	api-iam.intercom.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.212855101 CEST	192.168.2.5	1.1.1.1	0xcc2	Standard query (0)	api-iam.intercom.io	65	IN (0x0001)	false
Apr 26, 2024 19:12:59.019465923 CEST	192.168.2.5	1.1.1.1	0x1c5e	Standard query (0)	www.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:59.019855022 CEST	192.168.2.5	1.1.1.1	0x70ba	Standard query (0)	www.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:02.428481102 CEST	192.168.2.5	1.1.1.1	0x9758	Standard query (0)	s.go-mpulse.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:02.428617954 CEST	192.168.2.5	1.1.1.1	0x2d2b	Standard query (0)	s.go-mpulse.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:03.174298048 CEST	192.168.2.5	1.1.1.1	0xba32	Standard query (0)	www.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:03.174427986 CEST	192.168.2.5	1.1.1.1	0xadd0	Standard query (0)	www.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:03.590507030 CEST	192.168.2.5	1.1.1.1	0x811	Standard query (0)	c.go-mpulse.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:03.590648890 CEST	192.168.2.5	1.1.1.1	0x552d	Standard query (0)	c.go-mpulse.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:04.565466881 CEST	192.168.2.5	1.1.1.1	0x9cab	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.565601110 CEST	192.168.2.5	1.1.1.1	0x40e5	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:04.593122959 CEST	192.168.2.5	1.1.1.1	0x3c76	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.593270063 CEST	192.168.2.5	1.1.1.1	0xb9be	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:04.814069986 CEST	192.168.2.5	1.1.1.1	0xeb53	Standard query (0)	c.go-mpulse.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.814251900 CEST	192.168.2.5	1.1.1.1	0x2af7	Standard query (0)	c.go-mpulse.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:06.323908091 CEST	192.168.2.5	1.1.1.1	0x2ac9	Standard query (0)	c.go-mpulse.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.324065924 CEST	192.168.2.5	1.1.1.1	0xe214	Standard query (0)	c.go-mpulse.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:06.543956041 CEST	192.168.2.5	1.1.1.1	0xa444	Standard query (0)	xero.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.544148922 CEST	192.168.2.5	1.1.1.1	0xd3ba	Standard query (0)	xero.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:06.569785118 CEST	192.168.2.5	1.1.1.1	0xa87d	Standard query (0)	xero.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.569931984 CEST	192.168.2.5	1.1.1.1	0xc205	Standard query (0)	xero.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:06.570153952 CEST	192.168.2.5	1.1.1.1	0x98cf	Standard query (0)	xerolimited.sc.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.570288897 CEST	192.168.2.5	1.1.1.1	0x25e3	Standard query (0)	xerolimited.sc.omtrdc.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:06.609880924 CEST	192.168.2.5	1.1.1.1	0x5eb8	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.610133886 CEST	192.168.2.5	1.1.1.1	0x81b1	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:06.818299055 CEST	192.168.2.5	1.1.1.1	0xf265	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.818427086 CEST	192.168.2.5	1.1.1.1	0x682d	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:07.859056950 CEST	192.168.2.5	1.1.1.1	0x2926	Standard query (0)	xerolimited.sc.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.859395027 CEST	192.168.2.5	1.1.1.1	0x2bef	Standard query (0)	xerolimited.sc.omtrdc.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:07.859828949 CEST	192.168.2.5	1.1.1.1	0xb8cd	Standard query (0)	xero.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.859981060 CEST	192.168.2.5	1.1.1.1	0xb713	Standard query (0)	xero.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:08.186156988 CEST	192.168.2.5	1.1.1.1	0x19e2	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:08.186414957 CEST	192.168.2.5	1.1.1.1	0x15b2	Standard query (0)	cm.everesttech.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:08.506426096 CEST	192.168.2.5	1.1.1.1	0x3d74	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:08.506557941 CEST	192.168.2.5	1.1.1.1	0x29e2	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:09.387757063 CEST	192.168.2.5	1.1.1.1	0x366c	Standard query (0)	www.dwin1.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.387929916 CEST	192.168.2.5	1.1.1.1	0x18	Standard query (0)	www.dwin1.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:09.388803005 CEST	192.168.2.5	1.1.1.1	0x172b	Standard query (0)	www.redditstatic.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.389019012 CEST	192.168.2.5	1.1.1.1	0xdb50	Standard query (0)	www.redditstatic.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:09.409082890 CEST	192.168.2.5	1.1.1.1	0x7d72	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.409207106 CEST	192.168.2.5	1.1.1.1	0xdb63	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:09.473799944 CEST	192.168.2.5	1.1.1.1	0xb33	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.473927975 CEST	192.168.2.5	1.1.1.1	0x94cf	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.251794100 CEST	192.168.2.5	1.1.1.1	0x4327	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.251941919 CEST	192.168.2.5	1.1.1.1	0x50d8	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.407140017 CEST	192.168.2.5	1.1.1.1	0xa9de	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.407284021 CEST	192.168.2.5	1.1.1.1	0xa580	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.408056974 CEST	192.168.2.5	1.1.1.1	0x898a	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.408198118 CEST	192.168.2.5	1.1.1.1	0x8d5d	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.409235954 CEST	192.168.2.5	1.1.1.1	0xb040	Standard query (0)	tracking.g2crowd.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.409368992 CEST	192.168.2.5	1.1.1.1	0x5a40	Standard query (0)	tracking.g2crowd.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.655329943 CEST	192.168.2.5	1.1.1.1	0x2544	Standard query (0)	w3-reporting-nel.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.655632019 CEST	192.168.2.5	1.1.1.1	0x81bb	Standard query (0)	w3-reporting-nel.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.657995939 CEST	192.168.2.5	1.1.1.1	0xfa29	Standard query (0)	tags.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.658426046 CEST	192.168.2.5	1.1.1.1	0x41a6	Standard query (0)	tags.srv.stackadapt.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.660530090 CEST	192.168.2.5	1.1.1.1	0x29d	Standard query (0)	www.redditstatic.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.660696983 CEST	192.168.2.5	1.1.1.1	0x9683	Standard query (0)	www.redditstatic.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:10.843477011 CEST	192.168.2.5	1.1.1.1	0x5002	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.843600035 CEST	192.168.2.5	1.1.1.1	0x6eca	Standard query (0)	s.yimg.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:11.161947012 CEST	192.168.2.5	1.1.1.1	0x1cff	Standard query (0)	secure.quantserve.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.162074089 CEST	192.168.2.5	1.1.1.1	0xeb73	Standard query (0)	secure.quantserve.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:11.292916059 CEST	192.168.2.5	1.1.1.1	0x60cd	Standard query (0)	acdn.adnxs.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.293078899 CEST	192.168.2.5	1.1.1.1	0x65d	Standard query (0)	acdn.adnxs.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:11.294195890 CEST	192.168.2.5	1.1.1.1	0xbe99	Standard query (0)	js.adsrvr.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.294313908 CEST	192.168.2.5	1.1.1.1	0xf77f	Standard query (0)	js.adsrvr.org	65	IN (0x0001)	false
Apr 26, 2024 19:13:11.294840097 CEST	192.168.2.5	1.1.1.1	0x117f	Standard query (0)	tag.demandbase.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.295018911 CEST	192.168.2.5	1.1.1.1	0x28e3	Standard query (0)	tag.demandbase.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:11.296072960 CEST	192.168.2.5	1.1.1.1	0x9c42	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.296236992 CEST	192.168.2.5	1.1.1.1	0xb924	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:11.824151993 CEST	192.168.2.5	1.1.1.1	0x3cfa	Standard query (0)	9401320.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.824345112 CEST	192.168.2.5	1.1.1.1	0xd2d8	Standard query (0)	9401320.fls.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:11.825675011 CEST	192.168.2.5	1.1.1.1	0x86b3	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.825876951 CEST	192.168.2.5	1.1.1.1	0x1e45	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:12.215342045 CEST	192.168.2.5	1.1.1.1	0xc2e2	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.215533018 CEST	192.168.2.5	1.1.1.1	0xf04	Standard query (0)	s.yimg.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:12.251040936 CEST	192.168.2.5	1.1.1.1	0xfbe4	Standard query (0)	tags.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.251245975 CEST	192.168.2.5	1.1.1.1	0x4509	Standard query (0)	tags.srv.stackadapt.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:12.344527006 CEST	192.168.2.5	1.1.1.1	0x151d	Standard query (0)	alb.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.344696045 CEST	192.168.2.5	1.1.1.1	0xef62	Standard query (0)	alb.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:12.357527971 CEST	192.168.2.5	1.1.1.1	0x40a6	Standard query (0)	s.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.357770920 CEST	192.168.2.5	1.1.1.1	0xc51a	Standard query (0)	s.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:12.362667084 CEST	192.168.2.5	1.1.1.1	0x7599	Standard query (0)	api.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.362884045 CEST	192.168.2.5	1.1.1.1	0x9f67	Standard query (0)	api.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:12.823611021 CEST	192.168.2.5	1.1.1.1	0x8629	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.823807001 CEST	192.168.2.5	1.1.1.1	0x918	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.025074005 CEST	192.168.2.5	1.1.1.1	0x7e0b	Standard query (0)	static.ads-twitter.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.025254011 CEST	192.168.2.5	1.1.1.1	0x379d	Standard query (0)	static.ads-twitter.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.025887012 CEST	192.168.2.5	1.1.1.1	0xd278	Standard query (0)	alb.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.026082993 CEST	192.168.2.5	1.1.1.1	0xec0a	Standard query (0)	alb.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.067327023 CEST	192.168.2.5	1.1.1.1	0x850c	Standard query (0)	a.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.067524910 CEST	192.168.2.5	1.1.1.1	0x406a	Standard query (0)	a.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.068248034 CEST	192.168.2.5	1.1.1.1	0xf76	Standard query (0)	c.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.068444014 CEST	192.168.2.5	1.1.1.1	0x3c47	Standard query (0)	c.amazon-adsystem.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.072936058 CEST	192.168.2.5	1.1.1.1	0x98a4	Standard query (0)	api.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.073137045 CEST	192.168.2.5	1.1.1.1	0x8f38	Standard query (0)	api.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.082514048 CEST	192.168.2.5	1.1.1.1	0x9838	Standard query (0)	tag-logger.demandbase.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.082710981 CEST	192.168.2.5	1.1.1.1	0x39aa	Standard query (0)	tag-logger.demandbase.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.185204029 CEST	192.168.2.5	1.1.1.1	0x9b72	Standard query (0)	dsum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.185473919 CEST	192.168.2.5	1.1.1.1	0xa68d	Standard query (0)	dsum-sec.casalemedia.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.186549902 CEST	192.168.2.5	1.1.1.1	0x8539	Standard query (0)	partners.tremorhub.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.186827898 CEST	192.168.2.5	1.1.1.1	0xe077	Standard query (0)	partners.tremorhub.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.188894033 CEST	192.168.2.5	1.1.1.1	0x57d0	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.189163923 CEST	192.168.2.5	1.1.1.1	0xb42f	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.404572964 CEST	192.168.2.5	1.1.1.1	0x98ba	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.404906988 CEST	192.168.2.5	1.1.1.1	0x8a6b	Standard query (0)	www.linkedin.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.455663919 CEST	192.168.2.5	1.1.1.1	0xcfa3	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.455801964 CEST	192.168.2.5	1.1.1.1	0x8b99	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.680721998 CEST	192.168.2.5	1.1.1.1	0xfd07	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.681210041 CEST	192.168.2.5	1.1.1.1	0x6bc9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.726537943 CEST	192.168.2.5	1.1.1.1	0xcd16	Standard query (0)	aax-eu.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.728683949 CEST	192.168.2.5	1.1.1.1	0xf7b7	Standard query (0)	aax-eu.amazon-adsystem.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.839976072 CEST	192.168.2.5	1.1.1.1	0x2ec0	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.840174913 CEST	192.168.2.5	1.1.1.1	0x8d43	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.840729952 CEST	192.168.2.5	1.1.1.1	0xa665	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.840910912 CEST	192.168.2.5	1.1.1.1	0xec4c	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:13.843543053 CEST	192.168.2.5	1.1.1.1	0x323a	Standard query (0)	tag-logger.demandbase.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.843822002 CEST	192.168.2.5	1.1.1.1	0x4c5c	Standard query (0)	tag-logger.demandbase.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:15.452439070 CEST	192.168.2.5	1.1.1.1	0x722f	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.452636003 CEST	192.168.2.5	1.1.1.1	0x8017	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:15.452914953 CEST	192.168.2.5	1.1.1.1	0xd89b	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.453087091 CEST	192.168.2.5	1.1.1.1	0x9413	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:15.453361034 CEST	192.168.2.5	1.1.1.1	0x3f64	Standard query (0)	tag-logger.demandbase.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.453680038 CEST	192.168.2.5	1.1.1.1	0x31c2	Standard query (0)	tag-logger.demandbase.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:15.582746983 CEST	192.168.2.5	1.1.1.1	0x3522	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.582933903 CEST	192.168.2.5	1.1.1.1	0xe5d3	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:15.725142956 CEST	192.168.2.5	1.1.1.1	0x2d27	Standard query (0)	partners.tremorhub.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.725289106 CEST	192.168.2.5	1.1.1.1	0x4339	Standard query (0)	partners.tremorhub.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:15.726526976 CEST	192.168.2.5	1.1.1.1	0x846	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.726643085 CEST	192.168.2.5	1.1.1.1	0xe93c	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:15.730576992 CEST	192.168.2.5	1.1.1.1	0xd764	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.730770111 CEST	192.168.2.5	1.1.1.1	0x90a3	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.228992939 CEST	192.168.2.5	1.1.1.1	0xdf25	Standard query (0)	rules.quantcount.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.229227066 CEST	192.168.2.5	1.1.1.1	0xbca6	Standard query (0)	rules.quantcount.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.312777996 CEST	192.168.2.5	1.1.1.1	0x17	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.312962055 CEST	192.168.2.5	1.1.1.1	0xa27	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.314373970 CEST	192.168.2.5	1.1.1.1	0xd2c8	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.314590931 CEST	192.168.2.5	1.1.1.1	0xdd57	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.316863060 CEST	192.168.2.5	1.1.1.1	0x1efb	Standard query (0)	sp.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.317003012 CEST	192.168.2.5	1.1.1.1	0x3c84	Standard query (0)	sp.analytics.yahoo.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.317370892 CEST	192.168.2.5	1.1.1.1	0x6fd6	Standard query (0)	id.rlcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.317492008 CEST	192.168.2.5	1.1.1.1	0xcf89	Standard query (0)	id.rlcdn.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.498694897 CEST	192.168.2.5	1.1.1.1	0x283c	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.498903990 CEST	192.168.2.5	1.1.1.1	0x9c79	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.516403913 CEST	192.168.2.5	1.1.1.1	0xf5b1	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.516593933 CEST	192.168.2.5	1.1.1.1	0x2005	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.517596006 CEST	192.168.2.5	1.1.1.1	0xd74c	Standard query (0)	dsum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.517740011 CEST	192.168.2.5	1.1.1.1	0x9fcb	Standard query (0)	dsum-sec.casalemedia.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.518187046 CEST	192.168.2.5	1.1.1.1	0x2749	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.518351078 CEST	192.168.2.5	1.1.1.1	0x389f	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:16.519649982 CEST	192.168.2.5	1.1.1.1	0x9e23	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.519789934 CEST	192.168.2.5	1.1.1.1	0xce49	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.161510944 CEST	192.168.2.5	1.1.1.1	0xe307	Standard query (0)	ara.paa-reporting-advertising.amazon	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.161732912 CEST	192.168.2.5	1.1.1.1	0xac5d	Standard query (0)	ara.paa-reporting-advertising.amazon	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.163420916 CEST	192.168.2.5	1.1.1.1	0x2d20	Standard query (0)	aax-eu.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.163584948 CEST	192.168.2.5	1.1.1.1	0x67c2	Standard query (0)	aax-eu.amazon-adsystem.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.165508032 CEST	192.168.2.5	1.1.1.1	0x663b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.165638924 CEST	192.168.2.5	1.1.1.1	0xfbbd	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.184444904 CEST	192.168.2.5	1.1.1.1	0xcd4d	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.184565067 CEST	192.168.2.5	1.1.1.1	0x3346	Standard query (0)	t.co	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.185950041 CEST	192.168.2.5	1.1.1.1	0x5d56	Standard query (0)	sp.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.186202049 CEST	192.168.2.5	1.1.1.1	0x20dd	Standard query (0)	sp.analytics.yahoo.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.670512915 CEST	192.168.2.5	1.1.1.1	0xf55b	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.670650959 CEST	192.168.2.5	1.1.1.1	0x5e50	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.718298912 CEST	192.168.2.5	1.1.1.1	0x8a27	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.718431950 CEST	192.168.2.5	1.1.1.1	0xd67d	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.839282036 CEST	192.168.2.5	1.1.1.1	0xd831	Standard query (0)	pixel.quantserve.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.839437008 CEST	192.168.2.5	1.1.1.1	0x3b8f	Standard query (0)	pixel.quantserve.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.845735073 CEST	192.168.2.5	1.1.1.1	0xfb36	Standard query (0)	ara.paa-reporting-advertising.amazon	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.845863104 CEST	192.168.2.5	1.1.1.1	0xe5d5	Standard query (0)	ara.paa-reporting-advertising.amazon	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.856116056 CEST	192.168.2.5	1.1.1.1	0xc63c	Standard query (0)	segments.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.856327057 CEST	192.168.2.5	1.1.1.1	0xe9ba	Standard query (0)	segments.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:17.921468019 CEST	192.168.2.5	1.1.1.1	0xf962	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.921612978 CEST	192.168.2.5	1.1.1.1	0xf7ef	Standard query (0)	t.co	65	IN (0x0001)	false
Apr 26, 2024 19:13:18.485296011 CEST	192.168.2.5	1.1.1.1	0xfd52	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.485438108 CEST	192.168.2.5	1.1.1.1	0xd218	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:18.545257092 CEST	192.168.2.5	1.1.1.1	0x35cf	Standard query (0)	segments.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.545411110 CEST	192.168.2.5	1.1.1.1	0x3789	Standard query (0)	segments.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:18.826128960 CEST	192.168.2.5	1.1.1.1	0xadd5	Standard query (0)	pixel.quantserve.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.826514006 CEST	192.168.2.5	1.1.1.1	0xd5cc	Standard query (0)	pixel.quantserve.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:19.375241995 CEST	192.168.2.5	1.1.1.1	0x5942	Standard query (0)	insight.adsrvr.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:19.375354052 CEST	192.168.2.5	1.1.1.1	0xb7e7	Standard query (0)	insight.adsrvr.org	65	IN (0x0001)	false
Apr 26, 2024 19:13:20.279411077 CEST	192.168.2.5	1.1.1.1	0xf1f6	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:20.279542923 CEST	192.168.2.5	1.1.1.1	0x6263	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Apr 26, 2024 19:13:22.311548948 CEST	192.168.2.5	1.1.1.1	0x9b94	Standard query (0)	js.adsrvr.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:22.311691046 CEST	192.168.2.5	1.1.1.1	0x8313	Standard query (0)	js.adsrvr.org	65	IN (0x0001)	false
Apr 26, 2024 19:13:23.130011082 CEST	192.168.2.5	1.1.1.1	0x913e	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.130234003 CEST	192.168.2.5	1.1.1.1	0x3573	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:23.135124922 CEST	192.168.2.5	1.1.1.1	0xd7c2	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.135303020 CEST	192.168.2.5	1.1.1.1	0x1d49	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:23.140017033 CEST	192.168.2.5	1.1.1.1	0xfd77	Standard query (0)	tags.bluekai.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.140141964 CEST	192.168.2.5	1.1.1.1	0x4d65	Standard query (0)	tags.bluekai.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:32.486912966 CEST	192.168.2.5	1.1.1.1	0xe328	Standard query (0)	xerolimited.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.487062931 CEST	192.168.2.5	1.1.1.1	0x8052	Standard query (0)	xerolimited.tt.omtrdc.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:32.606089115 CEST	192.168.2.5	1.1.1.1	0xab1d	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.606219053 CEST	192.168.2.5	1.1.1.1	0x8a39	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:33.655524015 CEST	192.168.2.5	1.1.1.1	0xda3c	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:33.655642033 CEST	192.168.2.5	1.1.1.1	0x177b	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:33.984060049 CEST	192.168.2.5	1.1.1.1	0x3e7	Standard query (0)	xerolimited.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:33.984189034 CEST	192.168.2.5	1.1.1.1	0x26f0	Standard query (0)	xerolimited.tt.omtrdc.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:34.391227961 CEST	192.168.2.5	1.1.1.1	0xcffe	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.391355991 CEST	192.168.2.5	1.1.1.1	0x11d9	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:38.633359909 CEST	192.168.2.5	1.1.1.1	0x7250	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:38.633805037 CEST	192.168.2.5	1.1.1.1	0x2c5	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:38.648085117 CEST	192.168.2.5	1.1.1.1	0xfa60	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:38.648251057 CEST	192.168.2.5	1.1.1.1	0xc8eb	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:39.007163048 CEST	192.168.2.5	1.1.1.1	0xc90f	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:39.007409096 CEST	192.168.2.5	1.1.1.1	0x1986	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:39.374264956 CEST	192.168.2.5	1.1.1.1	0x3c61	Standard query (0)	id.rlcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:39.374397039 CEST	192.168.2.5	1.1.1.1	0x41d3	Standard query (0)	id.rlcdn.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:40.057971001 CEST	192.168.2.5	1.1.1.1	0xc33e	Standard query (0)	ws.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.058029890 CEST	192.168.2.5	1.1.1.1	0x28c8	Standard query (0)	ws.hotjar.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:40.105700970 CEST	192.168.2.5	1.1.1.1	0xdcd4	Standard query (0)	content.hotjar.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.105786085 CEST	192.168.2.5	1.1.1.1	0x744e	Standard query (0)	content.hotjar.io	65	IN (0x0001)	false
Apr 26, 2024 19:13:41.401763916 CEST	192.168.2.5	1.1.1.1	0xde23	Standard query (0)	content.hotjar.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:41.401884079 CEST	192.168.2.5	1.1.1.1	0x3f8c	Standard query (0)	content.hotjar.io	65	IN (0x0001)	false
Apr 26, 2024 19:13:41.957453966 CEST	192.168.2.5	1.1.1.1	0xe5ff	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:41.957520008 CEST	192.168.2.5	1.1.1.1	0xb0b7	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:42.007059097 CEST	192.168.2.5	1.1.1.1	0x5c19	Standard query (0)	pixel.tapad.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.007174969 CEST	192.168.2.5	1.1.1.1	0x24fd	Standard query (0)	pixel.tapad.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:44.272281885 CEST	192.168.2.5	1.1.1.1	0x193a	Standard query (0)	secure.adnxs.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.272419930 CEST	192.168.2.5	1.1.1.1	0x5c9a	Standard query (0)	secure.adnxs.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:51.850013018 CEST	192.168.2.5	1.1.1.1	0x9d6f	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:51.850189924 CEST	192.168.2.5	1.1.1.1	0x42ef	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:53.531860113 CEST	192.168.2.5	1.1.1.1	0xf186	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:53.532057047 CEST	192.168.2.5	1.1.1.1	0x3ddd	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:53.540797949 CEST	192.168.2.5	1.1.1.1	0x40d4	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:53.540920019 CEST	192.168.2.5	1.1.1.1	0x2020	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:13:56.043972969 CEST	192.168.2.5	1.1.1.1	0x49d7	Standard query (0)	aa.agkn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.044018984 CEST	192.168.2.5	1.1.1.1	0xef9e	Standard query (0)	aa.agkn.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:56.079027891 CEST	192.168.2.5	1.1.1.1	0x3cb	Standard query (0)	secure-gl.imrworldwide.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.079154015 CEST	192.168.2.5	1.1.1.1	0x6e25	Standard query (0)	secure-gl.imrworldwide.com	65	IN (0x0001)	false
Apr 26, 2024 19:13:56.703741074 CEST	192.168.2.5	1.1.1.1	0xc15b	Standard query (0)	d.agkn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.703814030 CEST	192.168.2.5	1.1.1.1	0x5bec	Standard query (0)	d.agkn.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:10.667464972 CEST	192.168.2.5	1.1.1.1	0xd9c3	Standard query (0)	w3-reporting-nel.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:10.667916059 CEST	192.168.2.5	1.1.1.1	0x52cd	Standard query (0)	w3-reporting-nel.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:11.226350069 CEST	192.168.2.5	1.1.1.1	0xd12f	Standard query (0)	w3-reporting-nel.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:11.226551056 CEST	192.168.2.5	1.1.1.1	0xbf73	Standard query (0)	w3-reporting-nel.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:13.031495094 CEST	192.168.2.5	1.1.1.1	0x28f6	Standard query (0)	www.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.031598091 CEST	192.168.2.5	1.1.1.1	0xb645	Standard query (0)	www.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:13.031837940 CEST	192.168.2.5	1.1.1.1	0x6586	Standard query (0)	xerolimited.sc.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.033613920 CEST	192.168.2.5	1.1.1.1	0xa754	Standard query (0)	xerolimited.sc.omtrdc.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:13.033945084 CEST	192.168.2.5	1.1.1.1	0x6a81	Standard query (0)	s.go-mpulse.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.034123898 CEST	192.168.2.5	1.1.1.1	0xfec0	Standard query (0)	s.go-mpulse.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:13.763323069 CEST	192.168.2.5	1.1.1.1	0x48ea	Standard query (0)	xero.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.763654947 CEST	192.168.2.5	1.1.1.1	0xb15d	Standard query (0)	xero.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:17.782289028 CEST	192.168.2.5	1.1.1.1	0x68e7	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:17.782428980 CEST	192.168.2.5	1.1.1.1	0xf0a9	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:17.949947119 CEST	192.168.2.5	1.1.1.1	0x4d04	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:17.950097084 CEST	192.168.2.5	1.1.1.1	0xd1e2	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:18.047245026 CEST	192.168.2.5	1.1.1.1	0xc51c	Standard query (0)	xero.demdex.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.047399998 CEST	192.168.2.5	1.1.1.1	0xfbf	Standard query (0)	xero.demdex.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:18.706619024 CEST	192.168.2.5	1.1.1.1	0xe41b	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.707006931 CEST	192.168.2.5	1.1.1.1	0x6e6d	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:18.818805933 CEST	192.168.2.5	1.1.1.1	0x571	Standard query (0)	www.redditstatic.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.819084883 CEST	192.168.2.5	1.1.1.1	0x39b7	Standard query (0)	www.redditstatic.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:18.826998949 CEST	192.168.2.5	1.1.1.1	0x3919	Standard query (0)	tags.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.827156067 CEST	192.168.2.5	1.1.1.1	0x7066	Standard query (0)	tags.srv.stackadapt.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:18.876682043 CEST	192.168.2.5	1.1.1.1	0x2de4	Standard query (0)	9401320.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.876889944 CEST	192.168.2.5	1.1.1.1	0x7a2e	Standard query (0)	9401320.fls.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:18.878073931 CEST	192.168.2.5	1.1.1.1	0x9a17	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.878344059 CEST	192.168.2.5	1.1.1.1	0x5f51	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:19.008493900 CEST	192.168.2.5	1.1.1.1	0x458c	Standard query (0)	js.adsrvr.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.008699894 CEST	192.168.2.5	1.1.1.1	0xc604	Standard query (0)	js.adsrvr.org	65	IN (0x0001)	false
Apr 26, 2024 19:14:19.024601936 CEST	192.168.2.5	1.1.1.1	0xd542	Standard query (0)	api.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.024892092 CEST	192.168.2.5	1.1.1.1	0xb7e8	Standard query (0)	api.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:19.028068066 CEST	192.168.2.5	1.1.1.1	0x4ad2	Standard query (0)	s.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.028256893 CEST	192.168.2.5	1.1.1.1	0x326d	Standard query (0)	s.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:19.629168034 CEST	192.168.2.5	1.1.1.1	0x7860	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.629333019 CEST	192.168.2.5	1.1.1.1	0x109e	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:21.286031008 CEST	192.168.2.5	1.1.1.1	0x4063	Standard query (0)	tag-logger.demandbase.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.286077023 CEST	192.168.2.5	1.1.1.1	0xdef4	Standard query (0)	tag-logger.demandbase.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:21.387567043 CEST	192.168.2.5	1.1.1.1	0x9f07	Standard query (0)	static.ads-twitter.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.387717009 CEST	192.168.2.5	1.1.1.1	0x3219	Standard query (0)	static.ads-twitter.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:21.454700947 CEST	192.168.2.5	1.1.1.1	0x360c	Standard query (0)	a.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.454876900 CEST	192.168.2.5	1.1.1.1	0x54ff	Standard query (0)	a.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:21.640989065 CEST	192.168.2.5	1.1.1.1	0x3938	Standard query (0)	api.company-target.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.641146898 CEST	192.168.2.5	1.1.1.1	0x1cb4	Standard query (0)	api.company-target.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:22.058872938 CEST	192.168.2.5	1.1.1.1	0xc334	Standard query (0)	tag-logger.demandbase.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.059012890 CEST	192.168.2.5	1.1.1.1	0x4f9b	Standard query (0)	tag-logger.demandbase.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:22.101478100 CEST	192.168.2.5	1.1.1.1	0x3bf2	Standard query (0)	aax-eu.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.101732016 CEST	192.168.2.5	1.1.1.1	0x7c3a	Standard query (0)	aax-eu.amazon-adsystem.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:22.219703913 CEST	192.168.2.5	1.1.1.1	0x37f4	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.219831944 CEST	192.168.2.5	1.1.1.1	0xe684	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:22.224762917 CEST	192.168.2.5	1.1.1.1	0x9d96	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.224906921 CEST	192.168.2.5	1.1.1.1	0xd1d4	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:22.233603001 CEST	192.168.2.5	1.1.1.1	0x9896	Standard query (0)	tags.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.233756065 CEST	192.168.2.5	1.1.1.1	0x6e5d	Standard query (0)	tags.srv.stackadapt.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:22.999057055 CEST	192.168.2.5	1.1.1.1	0xdc91	Standard query (0)	id.rlcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.999249935 CEST	192.168.2.5	1.1.1.1	0xf649	Standard query (0)	id.rlcdn.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.005876064 CEST	192.168.2.5	1.1.1.1	0x4000	Standard query (0)	alb.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.006021976 CEST	192.168.2.5	1.1.1.1	0xf875	Standard query (0)	alb.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.006344080 CEST	192.168.2.5	1.1.1.1	0x12cb	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.006632090 CEST	192.168.2.5	1.1.1.1	0x2834	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.007478952 CEST	192.168.2.5	1.1.1.1	0xe9bf	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.007611036 CEST	192.168.2.5	1.1.1.1	0x910c	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.022794962 CEST	192.168.2.5	1.1.1.1	0x7931	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.022974968 CEST	192.168.2.5	1.1.1.1	0xc574	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.025619984 CEST	192.168.2.5	1.1.1.1	0x76f5	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.025779009 CEST	192.168.2.5	1.1.1.1	0x5b30	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.395091057 CEST	192.168.2.5	1.1.1.1	0x4aad	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.395318985 CEST	192.168.2.5	1.1.1.1	0x31a4	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.396064043 CEST	192.168.2.5	1.1.1.1	0x15f2	Standard query (0)	ara.paa-reporting-advertising.amazon	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.396202087 CEST	192.168.2.5	1.1.1.1	0x658a	Standard query (0)	ara.paa-reporting-advertising.amazon	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.396801949 CEST	192.168.2.5	1.1.1.1	0x852	Standard query (0)	aax-eu.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.396939993 CEST	192.168.2.5	1.1.1.1	0xfbd8	Standard query (0)	aax-eu.amazon-adsystem.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.698138952 CEST	192.168.2.5	1.1.1.1	0xc669	Standard query (0)	alb.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.698268890 CEST	192.168.2.5	1.1.1.1	0x370b	Standard query (0)	alb.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:23.952357054 CEST	192.168.2.5	1.1.1.1	0x44da	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.952550888 CEST	192.168.2.5	1.1.1.1	0x8989	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:24.038269997 CEST	192.168.2.5	1.1.1.1	0x1f15	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.038774967 CEST	192.168.2.5	1.1.1.1	0xad11	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:24.067521095 CEST	192.168.2.5	1.1.1.1	0xb74a	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.067677975 CEST	192.168.2.5	1.1.1.1	0x904f	Standard query (0)	t.co	65	IN (0x0001)	false
Apr 26, 2024 19:14:24.068237066 CEST	192.168.2.5	1.1.1.1	0x8e38	Standard query (0)	pixel.quantserve.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.068370104 CEST	192.168.2.5	1.1.1.1	0xe98c	Standard query (0)	pixel.quantserve.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:24.073359966 CEST	192.168.2.5	1.1.1.1	0x5f97	Standard query (0)	ara.paa-reporting-advertising.amazon	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.073513985 CEST	192.168.2.5	1.1.1.1	0x11a1	Standard query (0)	ara.paa-reporting-advertising.amazon	65	IN (0x0001)	false
Apr 26, 2024 19:14:24.881809950 CEST	192.168.2.5	1.1.1.1	0xf246	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.882354975 CEST	192.168.2.5	1.1.1.1	0xfb8f	Standard query (0)	t.co	65	IN (0x0001)	false
Apr 26, 2024 19:14:25.023284912 CEST	192.168.2.5	1.1.1.1	0x727b	Standard query (0)	pixel.quantserve.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.023646116 CEST	192.168.2.5	1.1.1.1	0x3380	Standard query (0)	pixel.quantserve.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:25.062088013 CEST	192.168.2.5	1.1.1.1	0x8d7c	Standard query (0)	nexus-websocket-a.intercom.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.062597036 CEST	192.168.2.5	1.1.1.1	0x514e	Standard query (0)	nexus-websocket-a.intercom.io	65	IN (0x0001)	false
Apr 26, 2024 19:14:27.530636072 CEST	192.168.2.5	1.1.1.1	0x38b0	Standard query (0)	su.addthis.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.530785084 CEST	192.168.2.5	1.1.1.1	0x87fb	Standard query (0)	su.addthis.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:27.550631046 CEST	192.168.2.5	1.1.1.1	0x4092	Standard query (0)	idpix.media6degrees.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.550820112 CEST	192.168.2.5	1.1.1.1	0xb8d7	Standard query (0)	idpix.media6degrees.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:27.562361002 CEST	192.168.2.5	1.1.1.1	0x3fbc	Standard query (0)	dmp.truoptik.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.562551975 CEST	192.168.2.5	1.1.1.1	0x239a	Standard query (0)	dmp.truoptik.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:35.511147976 CEST	192.168.2.5	1.1.1.1	0x2d1a	Standard query (0)	xerolimited.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.511380911 CEST	192.168.2.5	1.1.1.1	0xb9bf	Standard query (0)	xerolimited.tt.omtrdc.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:35.672859907 CEST	192.168.2.5	1.1.1.1	0xae4f	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.673022985 CEST	192.168.2.5	1.1.1.1	0x462d	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:36.476576090 CEST	192.168.2.5	1.1.1.1	0x9a2e	Standard query (0)	xerolimited.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.476722002 CEST	192.168.2.5	1.1.1.1	0xdc1b	Standard query (0)	xerolimited.tt.omtrdc.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:36.663768053 CEST	192.168.2.5	1.1.1.1	0xb97f	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.664156914 CEST	192.168.2.5	1.1.1.1	0x4489	Standard query (0)	user-tracking-api.dgt-digital-marketing.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:39.082607031 CEST	192.168.2.5	1.1.1.1	0x5f5c	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:39.082751989 CEST	192.168.2.5	1.1.1.1	0x238f	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:41.003386021 CEST	192.168.2.5	1.1.1.1	0xf125	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:41.003551006 CEST	192.168.2.5	1.1.1.1	0xbdc3	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:41.494023085 CEST	192.168.2.5	1.1.1.1	0x6e5	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:41.494188070 CEST	192.168.2.5	1.1.1.1	0xa22a	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:41.673969030 CEST	192.168.2.5	1.1.1.1	0x3b93	Standard query (0)	id.rlcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:41.674113035 CEST	192.168.2.5	1.1.1.1	0xba52	Standard query (0)	id.rlcdn.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:42.047058105 CEST	192.168.2.5	1.1.1.1	0x7a53	Standard query (0)	ws.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.047236919 CEST	192.168.2.5	1.1.1.1	0x59a7	Standard query (0)	ws.hotjar.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:42.064558029 CEST	192.168.2.5	1.1.1.1	0x4b9	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.064709902 CEST	192.168.2.5	1.1.1.1	0x426	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:42.118844032 CEST	192.168.2.5	1.1.1.1	0xc7ec	Standard query (0)	content.hotjar.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.119019032 CEST	192.168.2.5	1.1.1.1	0x258b	Standard query (0)	content.hotjar.io	65	IN (0x0001)	false
Apr 26, 2024 19:14:42.864921093 CEST	192.168.2.5	1.1.1.1	0x2302	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.865041971 CEST	192.168.2.5	1.1.1.1	0xd551	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:43.381630898 CEST	192.168.2.5	1.1.1.1	0x60e6	Standard query (0)	content.hotjar.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:43.381772995 CEST	192.168.2.5	1.1.1.1	0xdd8	Standard query (0)	content.hotjar.io	65	IN (0x0001)	false
Apr 26, 2024 19:14:44.376847982 CEST	192.168.2.5	1.1.1.1	0x21bf	Standard query (0)	tags.rd.linksynergy.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.376981974 CEST	192.168.2.5	1.1.1.1	0x32b0	Standard query (0)	tags.rd.linksynergy.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:44.377449989 CEST	192.168.2.5	1.1.1.1	0x5eaf	Standard query (0)	uipglob.semasio.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.377640009 CEST	192.168.2.5	1.1.1.1	0xd3e8	Standard query (0)	uipglob.semasio.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:44.378037930 CEST	192.168.2.5	1.1.1.1	0xf741	Standard query (0)	mid.rkdms.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.378173113 CEST	192.168.2.5	1.1.1.1	0x5509	Standard query (0)	mid.rkdms.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:45.258019924 CEST	192.168.2.5	1.1.1.1	0xe63e	Standard query (0)	track2.securedvisit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:45.258183002 CEST	192.168.2.5	1.1.1.1	0x7d5b	Standard query (0)	track2.securedvisit.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:53.053668976 CEST	192.168.2.5	1.1.1.1	0xb8ae	Standard query (0)	ml314.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:53.053795099 CEST	192.168.2.5	1.1.1.1	0xb44	Standard query (0)	ml314.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:53.074537039 CEST	192.168.2.5	1.1.1.1	0xe2d3	Standard query (0)	eb2.3lift.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:53.074671030 CEST	192.168.2.5	1.1.1.1	0xc80d	Standard query (0)	eb2.3lift.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:54.222289085 CEST	192.168.2.5	1.1.1.1	0x6f69	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:54.222434998 CEST	192.168.2.5	1.1.1.1	0x1a9d	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:54.223925114 CEST	192.168.2.5	1.1.1.1	0x90e3	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:54.224222898 CEST	192.168.2.5	1.1.1.1	0x9869	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:14:57.234596968 CEST	192.168.2.5	1.1.1.1	0xfe8b	Standard query (0)	www.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:57.234630108 CEST	192.168.2.5	1.1.1.1	0xe4d0	Standard query (0)	www.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:14:57.582180023 CEST	192.168.2.5	1.1.1.1	0x772c	Standard query (0)	tracking.g2crowd.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:57.582324028 CEST	192.168.2.5	1.1.1.1	0xce0a	Standard query (0)	tracking.g2crowd.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:00.331618071 CEST	192.168.2.5	1.1.1.1	0x6466	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:00.331756115 CEST	192.168.2.5	1.1.1.1	0x3300	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:00.919944048 CEST	192.168.2.5	1.1.1.1	0x1a99	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:00.920136929 CEST	192.168.2.5	1.1.1.1	0x22c3	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:15:00.992985964 CEST	192.168.2.5	1.1.1.1	0x453	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:00.993144989 CEST	192.168.2.5	1.1.1.1	0xf6a9	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:15:02.032732010 CEST	192.168.2.5	1.1.1.1	0x2e1d	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:02.032847881 CEST	192.168.2.5	1.1.1.1	0xb128	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:05.368355989 CEST	192.168.2.5	1.1.1.1	0x7ad6	Standard query (0)	metrics.hotjar.io	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:05.368489027 CEST	192.168.2.5	1.1.1.1	0x42d2	Standard query (0)	metrics.hotjar.io	65	IN (0x0001)	false
Apr 26, 2024 19:15:09.703727961 CEST	192.168.2.5	1.1.1.1	0x104b	Standard query (0)	match.sharethrough.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.703911066 CEST	192.168.2.5	1.1.1.1	0x1eac	Standard query (0)	match.sharethrough.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:09.770840883 CEST	192.168.2.5	1.1.1.1	0x6f26	Standard query (0)	cw.addthis.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.770992041 CEST	192.168.2.5	1.1.1.1	0xd049	Standard query (0)	cw.addthis.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:10.304887056 CEST	192.168.2.5	1.1.1.1	0x64ae	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:10.305100918 CEST	192.168.2.5	1.1.1.1	0x1cd1	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:15:11.213428020 CEST	192.168.2.5	1.1.1.1	0x6bac	Standard query (0)	w3-reporting-nel.reddit.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:11.213644028 CEST	192.168.2.5	1.1.1.1	0x6c0c	Standard query (0)	w3-reporting-nel.reddit.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:14.198527098 CEST	192.168.2.5	1.1.1.1	0xcf22	Standard query (0)	www.xero.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:14.199141026 CEST	192.168.2.5	1.1.1.1	0x73a0	Standard query (0)	www.xero.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:31.913533926 CEST	192.168.2.5	1.1.1.1	0x6880	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:31.913660049 CEST	192.168.2.5	1.1.1.1	0x1cbd	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:34.688025951 CEST	192.168.2.5	1.1.1.1	0xcf4c	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:34.688359022 CEST	192.168.2.5	1.1.1.1	0x630a	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:37.137938976 CEST	192.168.2.5	1.1.1.1	0xa48d	Standard query (0)	tags.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.138246059 CEST	192.168.2.5	1.1.1.1	0x9c8d	Standard query (0)	tags.srv.stackadapt.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:37.894603014 CEST	192.168.2.5	1.1.1.1	0xd36b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.895023108 CEST	192.168.2.5	1.1.1.1	0x215c	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:37.903254986 CEST	192.168.2.5	1.1.1.1	0xcd67	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.903480053 CEST	192.168.2.5	1.1.1.1	0x80b5	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:15:37.912895918 CEST	192.168.2.5	1.1.1.1	0x7afc	Standard query (0)	tags.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.913198948 CEST	192.168.2.5	1.1.1.1	0xa9c	Standard query (0)	tags.srv.stackadapt.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:38.542645931 CEST	192.168.2.5	1.1.1.1	0xce43	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.542835951 CEST	192.168.2.5	1.1.1.1	0x3c6b	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:40.393644094 CEST	192.168.2.5	1.1.1.1	0xdab4	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.393870115 CEST	192.168.2.5	1.1.1.1	0xef5e	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:15:40.778347015 CEST	192.168.2.5	1.1.1.1	0x9525	Standard query (0)	940320.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.778707981 CEST	192.168.2.5	1.1.1.1	0x94ca	Standard query (0)	940320.fls.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:15:40.798238039 CEST	192.168.2.5	1.1.1.1	0x57d4	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.798674107 CEST	192.168.2.5	1.1.1.1	0xfc34	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 19:15:43.116564035 CEST	192.168.2.5	1.1.1.1	0x9347	Standard query (0)	ws.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.116710901 CEST	192.168.2.5	1.1.1.1	0x61b1	Standard query (0)	ws.hotjar.com	65	IN (0x0001)	false
Apr 26, 2024 19:15:43.217421055 CEST	192.168.2.5	1.1.1.1	0x244c	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.217896938 CEST	192.168.2.5	1.1.1.1	0x84d1	Standard query (0)	adservice.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 19:12:34.763716936 CEST	1.1.1.1	192.168.2.5	0x37f7	No error (0)	in.xero.com	in.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:34.805847883 CEST	1.1.1.1	192.168.2.5	0x9615	No error (0)	in.xero.com	in.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:37.987829924 CEST	1.1.1.1	192.168.2.5	0xb89c	No error (0)	edge.xero.com	new-edge.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:38.032474995 CEST	1.1.1.1	192.168.2.5	0x73aa	No error (0)	edge.xero.com	new-edge.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:39.259202003 CEST	1.1.1.1	192.168.2.5	0xf3ff	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:12:39.260085106 CEST	1.1.1.1	192.168.2.5	0xa184	No error (0)	www.google.com		142.250.217.228	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:42.018040895 CEST	1.1.1.1	192.168.2.5	0xf5d2	No error (0)	js-agent.newrelic.com		162.247.243.39	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:42.569766045 CEST	1.1.1.1	192.168.2.5	0x2ae2	No error (0)	edge.xero.com	new-edge.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:42.624610901 CEST	1.1.1.1	192.168.2.5	0x65ac	No error (0)	edge.xero.com	new-edge.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:42.840715885 CEST	1.1.1.1	192.168.2.5	0x292c	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:42.840715885 CEST	1.1.1.1	192.168.2.5	0x292c	No error (0)	bam.cell.nr-data.net	bam.nr-data.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:42.841115952 CEST	1.1.1.1	192.168.2.5	0xf394	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:42.841115952 CEST	1.1.1.1	192.168.2.5	0xf394	No error (0)	bam.cell.nr-data.net	fastly-tls12-bam.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:42.841115952 CEST	1.1.1.1	192.168.2.5	0xf394	No error (0)	fastly-tls12-bam.nr-data.net		162.247.243.29	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:46.012727022 CEST	1.1.1.1	192.168.2.5	0xfb0f	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:46.012727022 CEST	1.1.1.1	192.168.2.5	0xfb0f	No error (0)	bam.cell.nr-data.net	bam.nr-data.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:46.012792110 CEST	1.1.1.1	192.168.2.5	0x267d	No error (0)	bam.nr-data.net	bam.cell.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:46.012792110 CEST	1.1.1.1	192.168.2.5	0x267d	No error (0)	bam.cell.nr-data.net	fastly-tls12-bam.nr-data.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:46.012792110 CEST	1.1.1.1	192.168.2.5	0x267d	No error (0)	fastly-tls12-bam.nr-data.net		162.247.243.29	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:46.073810101 CEST	1.1.1.1	192.168.2.5	0xb85c	No error (0)	in.xero.com	in.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:46.074938059 CEST	1.1.1.1	192.168.2.5	0xeb6a	No error (0)	in.xero.com	in.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:47.311491966 CEST	1.1.1.1	192.168.2.5	0x7ccc	No error (0)	product-analytics-bff.xero.com	product-analytics-bff.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:47.358577013 CEST	1.1.1.1	192.168.2.5	0xf0d5	No error (0)	product-analytics-bff.xero.com	product-analytics-bff.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:47.924015999 CEST	1.1.1.1	192.168.2.5	0xf61	No error (0)	widget.intercom.io		13.32.87.102	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:47.924015999 CEST	1.1.1.1	192.168.2.5	0xf61	No error (0)	widget.intercom.io		13.32.87.112	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:47.924015999 CEST	1.1.1.1	192.168.2.5	0xf61	No error (0)	widget.intercom.io		13.32.87.59	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:47.924015999 CEST	1.1.1.1	192.168.2.5	0xf61	No error (0)	widget.intercom.io		13.32.87.81	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:50.102308035 CEST	1.1.1.1	192.168.2.5	0xc410	No error (0)	js.intercomcdn.com		13.226.52.4	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:50.102308035 CEST	1.1.1.1	192.168.2.5	0xc410	No error (0)	js.intercomcdn.com		13.226.52.58	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:50.102308035 CEST	1.1.1.1	192.168.2.5	0xc410	No error (0)	js.intercomcdn.com		13.226.52.93	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:50.102308035 CEST	1.1.1.1	192.168.2.5	0xc410	No error (0)	js.intercomcdn.com		13.226.52.91	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		54.165.219.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		3.214.248.84	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		3.216.18.136	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		3.219.101.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		35.168.118.226	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		52.55.103.136	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		44.209.253.226	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:51.273994923 CEST	1.1.1.1	192.168.2.5	0x348a	No error (0)	api-iam.intercom.io		44.217.183.210	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:53.802778959 CEST	1.1.1.1	192.168.2.5	0x1f56	No error (0)	nexus-websocket-a.intercom.io		35.174.127.31	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:53.802778959 CEST	1.1.1.1	192.168.2.5	0x1f56	No error (0)	nexus-websocket-a.intercom.io		34.237.73.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		34.196.171.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		44.217.183.210	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		44.197.106.171	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		3.219.101.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		54.165.219.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		34.199.118.93	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		44.214.72.116	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:55.338084936 CEST	1.1.1.1	192.168.2.5	0xc6de	No error (0)	api-iam.intercom.io		3.216.18.136	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:12:59.149373055 CEST	1.1.1.1	192.168.2.5	0x70ba	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:12:59.195076942 CEST	1.1.1.1	192.168.2.5	0x1c5e	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:02.553119898 CEST	1.1.1.1	192.168.2.5	0x9758	No error (0)	s.go-mpulse.net	ip46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:02.553704977 CEST	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	s.go-mpulse.net	ip46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:03.303050041 CEST	1.1.1.1	192.168.2.5	0xba32	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:03.346540928 CEST	1.1.1.1	192.168.2.5	0xadd0	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:03.715681076 CEST	1.1.1.1	192.168.2.5	0x811	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:03.716571093 CEST	1.1.1.1	192.168.2.5	0x552d	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.690443993 CEST	1.1.1.1	192.168.2.5	0x9cab	No error (0)	widget.trustpilot.com		13.249.98.6	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.690443993 CEST	1.1.1.1	192.168.2.5	0x9cab	No error (0)	widget.trustpilot.com		13.249.98.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.690443993 CEST	1.1.1.1	192.168.2.5	0x9cab	No error (0)	widget.trustpilot.com		13.249.98.119	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.690443993 CEST	1.1.1.1	192.168.2.5	0x9cab	No error (0)	widget.trustpilot.com		13.249.98.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.215.173.78	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.4.85.254	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.225.234.85	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.210.17.65	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.21.188.91	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.215.223.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.156.87.255	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.718533993 CEST	1.1.1.1	192.168.2.5	0x3c76	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.193.186.241	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:04.719017982 CEST	1.1.1.1	192.168.2.5	0xb9be	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.719017982 CEST	1.1.1.1	192.168.2.5	0xb9be	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.719017982 CEST	1.1.1.1	192.168.2.5	0xb9be	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.940052986 CEST	1.1.1.1	192.168.2.5	0x2af7	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:04.940907001 CEST	1.1.1.1	192.168.2.5	0xeb53	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.449866056 CEST	1.1.1.1	192.168.2.5	0xe214	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.449888945 CEST	1.1.1.1	192.168.2.5	0x2ac9	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.691771030 CEST	1.1.1.1	192.168.2.5	0xd3ba	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.691771030 CEST	1.1.1.1	192.168.2.5	0xd3ba	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.691771030 CEST	1.1.1.1	192.168.2.5	0xd3ba	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.40.174.159	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.215.200.243	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.213.75.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.43.4.113	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		100.20.115.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		100.21.16.173	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.43.228.114	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.693202019 CEST	1.1.1.1	192.168.2.5	0xa444	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		54.191.97.222	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.22	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.55	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.138	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.189	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.699258089 CEST	1.1.1.1	192.168.2.5	0x98cf	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.9	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.713896990 CEST	1.1.1.1	192.168.2.5	0xc205	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.713896990 CEST	1.1.1.1	192.168.2.5	0xc205	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.713896990 CEST	1.1.1.1	192.168.2.5	0xc205	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.156.87.255	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.230.68.217	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		18.233.26.246	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.0.46.206	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.45.64.254	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.215.223.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.225.234.85	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.718439102 CEST	1.1.1.1	192.168.2.5	0xa87d	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		50.16.212.141	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.198.199.61	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.152.115.234	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.231.73.197	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.192.59.101	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.208.48.255	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.238.61.171	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.225.234.85	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735265017 CEST	1.1.1.1	192.168.2.5	0x5eb8	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.146.244.228	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735475063 CEST	1.1.1.1	192.168.2.5	0x81b1	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735475063 CEST	1.1.1.1	192.168.2.5	0x81b1	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.735475063 CEST	1.1.1.1	192.168.2.5	0x81b1	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:06.945177078 CEST	1.1.1.1	192.168.2.5	0xf265	No error (0)	widget.trustpilot.com		13.249.98.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.945177078 CEST	1.1.1.1	192.168.2.5	0xf265	No error (0)	widget.trustpilot.com		13.249.98.6	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.945177078 CEST	1.1.1.1	192.168.2.5	0xf265	No error (0)	widget.trustpilot.com		13.249.98.119	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:06.945177078 CEST	1.1.1.1	192.168.2.5	0xf265	No error (0)	widget.trustpilot.com		13.249.98.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.138	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.189	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.9	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.82	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.988852978 CEST	1.1.1.1	192.168.2.5	0x2926	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.93	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.215.223.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		18.213.234.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.202.107.174	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.206.37.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.4.85.254	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.212.109.197	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.203.68.60	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:07.992141008 CEST	1.1.1.1	192.168.2.5	0xb8cd	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.200.158.58	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:08.008282900 CEST	1.1.1.1	192.168.2.5	0xb713	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:08.008282900 CEST	1.1.1.1	192.168.2.5	0xb713	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:08.008282900 CEST	1.1.1.1	192.168.2.5	0xb713	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:08.329247952 CEST	1.1.1.1	192.168.2.5	0x19e2	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:08.329308033 CEST	1.1.1.1	192.168.2.5	0x15b2	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:08.631376028 CEST	1.1.1.1	192.168.2.5	0x3d74	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:08.631936073 CEST	1.1.1.1	192.168.2.5	0x29e2	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.513741970 CEST	1.1.1.1	192.168.2.5	0x18	No error (0)	www.dwin1.com	d2pbcviywxotf2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514144897 CEST	1.1.1.1	192.168.2.5	0x172b	No error (0)	www.redditstatic.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514144897 CEST	1.1.1.1	192.168.2.5	0x172b	No error (0)	dualstack.reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514144897 CEST	1.1.1.1	192.168.2.5	0x172b	No error (0)	dualstack.reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514144897 CEST	1.1.1.1	192.168.2.5	0x172b	No error (0)	dualstack.reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514144897 CEST	1.1.1.1	192.168.2.5	0x172b	No error (0)	dualstack.reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514286995 CEST	1.1.1.1	192.168.2.5	0x366c	No error (0)	www.dwin1.com	d2pbcviywxotf2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514286995 CEST	1.1.1.1	192.168.2.5	0x366c	No error (0)	d2pbcviywxotf2.cloudfront.net		18.64.174.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514286995 CEST	1.1.1.1	192.168.2.5	0x366c	No error (0)	d2pbcviywxotf2.cloudfront.net		18.64.174.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514286995 CEST	1.1.1.1	192.168.2.5	0x366c	No error (0)	d2pbcviywxotf2.cloudfront.net		18.64.174.112	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.514286995 CEST	1.1.1.1	192.168.2.5	0x366c	No error (0)	d2pbcviywxotf2.cloudfront.net		18.64.174.109	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.515023947 CEST	1.1.1.1	192.168.2.5	0xdb50	No error (0)	www.redditstatic.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.535655022 CEST	1.1.1.1	192.168.2.5	0x7d72	No error (0)	widget.trustpilot.com		13.249.98.6	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.535655022 CEST	1.1.1.1	192.168.2.5	0x7d72	No error (0)	widget.trustpilot.com		13.249.98.119	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.535655022 CEST	1.1.1.1	192.168.2.5	0x7d72	No error (0)	widget.trustpilot.com		13.249.98.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.535655022 CEST	1.1.1.1	192.168.2.5	0x7d72	No error (0)	widget.trustpilot.com		13.249.98.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:09.598669052 CEST	1.1.1.1	192.168.2.5	0xb33	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.598669052 CEST	1.1.1.1	192.168.2.5	0xb33	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.599343061 CEST	1.1.1.1	192.168.2.5	0x94cf	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:09.599343061 CEST	1.1.1.1	192.168.2.5	0x94cf	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.377450943 CEST	1.1.1.1	192.168.2.5	0x50d8	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.377450943 CEST	1.1.1.1	192.168.2.5	0x50d8	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.377995014 CEST	1.1.1.1	192.168.2.5	0x4327	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.377995014 CEST	1.1.1.1	192.168.2.5	0x4327	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.532674074 CEST	1.1.1.1	192.168.2.5	0xa9de	No error (0)	stats.g.doubleclick.net		74.125.26.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.532674074 CEST	1.1.1.1	192.168.2.5	0xa9de	No error (0)	stats.g.doubleclick.net		74.125.26.154	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.532674074 CEST	1.1.1.1	192.168.2.5	0xa9de	No error (0)	stats.g.doubleclick.net		74.125.26.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.532674074 CEST	1.1.1.1	192.168.2.5	0xa9de	No error (0)	stats.g.doubleclick.net		74.125.26.156	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.534079075 CEST	1.1.1.1	192.168.2.5	0x8d5d	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.534200907 CEST	1.1.1.1	192.168.2.5	0x898a	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.534200907 CEST	1.1.1.1	192.168.2.5	0x898a	No error (0)	scontent.xx.fbcdn.net		157.240.14.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.534471035 CEST	1.1.1.1	192.168.2.5	0x5a40	No error (0)	tracking.g2crowd.com			65	IN (0x0001)	false
Apr 26, 2024 19:13:10.534691095 CEST	1.1.1.1	192.168.2.5	0xb040	No error (0)	tracking.g2crowd.com		172.64.144.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.534691095 CEST	1.1.1.1	192.168.2.5	0xb040	No error (0)	tracking.g2crowd.com		104.18.43.31	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.780512094 CEST	1.1.1.1	192.168.2.5	0x2544	No error (0)	w3-reporting-nel.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.780512094 CEST	1.1.1.1	192.168.2.5	0x2544	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.780512094 CEST	1.1.1.1	192.168.2.5	0x2544	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.780512094 CEST	1.1.1.1	192.168.2.5	0x2544	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.780512094 CEST	1.1.1.1	192.168.2.5	0x2544	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.781339884 CEST	1.1.1.1	192.168.2.5	0x81bb	No error (0)	w3-reporting-nel.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.783977032 CEST	1.1.1.1	192.168.2.5	0xfa29	No error (0)	tags.srv.stackadapt.com		18.210.82.4	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.783977032 CEST	1.1.1.1	192.168.2.5	0xfa29	No error (0)	tags.srv.stackadapt.com		52.86.27.147	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.783977032 CEST	1.1.1.1	192.168.2.5	0xfa29	No error (0)	tags.srv.stackadapt.com		18.210.31.191	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.783977032 CEST	1.1.1.1	192.168.2.5	0xfa29	No error (0)	tags.srv.stackadapt.com		100.26.119.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.783977032 CEST	1.1.1.1	192.168.2.5	0xfa29	No error (0)	tags.srv.stackadapt.com		3.225.21.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.783977032 CEST	1.1.1.1	192.168.2.5	0xfa29	No error (0)	tags.srv.stackadapt.com		54.84.194.59	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.785636902 CEST	1.1.1.1	192.168.2.5	0x29d	No error (0)	www.redditstatic.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.785636902 CEST	1.1.1.1	192.168.2.5	0x29d	No error (0)	dualstack.reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.785636902 CEST	1.1.1.1	192.168.2.5	0x29d	No error (0)	dualstack.reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.785636902 CEST	1.1.1.1	192.168.2.5	0x29d	No error (0)	dualstack.reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.785636902 CEST	1.1.1.1	192.168.2.5	0x29d	No error (0)	dualstack.reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.786194086 CEST	1.1.1.1	192.168.2.5	0x9683	No error (0)	www.redditstatic.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.969130039 CEST	1.1.1.1	192.168.2.5	0x6eca	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.969162941 CEST	1.1.1.1	192.168.2.5	0x5002	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:10.969162941 CEST	1.1.1.1	192.168.2.5	0x5002	No error (0)	edge.gycpi.b.yahoodns.net		68.180.135.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:10.969162941 CEST	1.1.1.1	192.168.2.5	0x5002	No error (0)	edge.gycpi.b.yahoodns.net		68.180.135.251	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.287132978 CEST	1.1.1.1	192.168.2.5	0x1cff	No error (0)	secure.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.287132978 CEST	1.1.1.1	192.168.2.5	0x1cff	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.287132978 CEST	1.1.1.1	192.168.2.5	0x1cff	No error (0)	global.px.quantserve.com		192.184.68.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.287132978 CEST	1.1.1.1	192.168.2.5	0x1cff	No error (0)	global.px.quantserve.com		192.184.68.234	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.287132978 CEST	1.1.1.1	192.168.2.5	0x1cff	No error (0)	global.px.quantserve.com		192.184.68.149	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.289844036 CEST	1.1.1.1	192.168.2.5	0xeb73	No error (0)	secure.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.289844036 CEST	1.1.1.1	192.168.2.5	0xeb73	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.419606924 CEST	1.1.1.1	192.168.2.5	0x60cd	No error (0)	acdn.adnxs.com	secure-adnxs.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.419644117 CEST	1.1.1.1	192.168.2.5	0xf77f	No error (0)	js.adsrvr.org	dg2iu7dxxehbo.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.419864893 CEST	1.1.1.1	192.168.2.5	0xbe99	No error (0)	js.adsrvr.org	dg2iu7dxxehbo.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.419864893 CEST	1.1.1.1	192.168.2.5	0xbe99	No error (0)	dg2iu7dxxehbo.cloudfront.net		18.64.168.121	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421042919 CEST	1.1.1.1	192.168.2.5	0x9c42	No error (0)	stats.g.doubleclick.net		173.194.216.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421042919 CEST	1.1.1.1	192.168.2.5	0x9c42	No error (0)	stats.g.doubleclick.net		173.194.216.154	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421042919 CEST	1.1.1.1	192.168.2.5	0x9c42	No error (0)	stats.g.doubleclick.net		173.194.216.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421042919 CEST	1.1.1.1	192.168.2.5	0x9c42	No error (0)	stats.g.doubleclick.net		173.194.216.156	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421216965 CEST	1.1.1.1	192.168.2.5	0x117f	No error (0)	tag.demandbase.com		13.249.98.101	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421216965 CEST	1.1.1.1	192.168.2.5	0x117f	No error (0)	tag.demandbase.com		13.249.98.52	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421216965 CEST	1.1.1.1	192.168.2.5	0x117f	No error (0)	tag.demandbase.com		13.249.98.5	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.421216965 CEST	1.1.1.1	192.168.2.5	0x117f	No error (0)	tag.demandbase.com		13.249.98.43	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.950689077 CEST	1.1.1.1	192.168.2.5	0x86b3	No error (0)	td.doubleclick.net		192.178.50.34	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.986955881 CEST	1.1.1.1	192.168.2.5	0x3cfa	No error (0)	9401320.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:11.986955881 CEST	1.1.1.1	192.168.2.5	0x3cfa	No error (0)	dart.l.doubleclick.net		142.250.217.166	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:11.990729094 CEST	1.1.1.1	192.168.2.5	0xd2d8	No error (0)	9401320.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:12.340241909 CEST	1.1.1.1	192.168.2.5	0xc2e2	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:12.340241909 CEST	1.1.1.1	192.168.2.5	0xc2e2	No error (0)	edge.gycpi.b.yahoodns.net		68.180.135.251	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.340241909 CEST	1.1.1.1	192.168.2.5	0xc2e2	No error (0)	edge.gycpi.b.yahoodns.net		68.180.135.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.341489077 CEST	1.1.1.1	192.168.2.5	0xf04	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:12.377794027 CEST	1.1.1.1	192.168.2.5	0xfbe4	No error (0)	tags.srv.stackadapt.com		54.84.194.59	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.377794027 CEST	1.1.1.1	192.168.2.5	0xfbe4	No error (0)	tags.srv.stackadapt.com		18.210.82.4	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.377794027 CEST	1.1.1.1	192.168.2.5	0xfbe4	No error (0)	tags.srv.stackadapt.com		18.210.31.191	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.377794027 CEST	1.1.1.1	192.168.2.5	0xfbe4	No error (0)	tags.srv.stackadapt.com		100.26.119.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.377794027 CEST	1.1.1.1	192.168.2.5	0xfbe4	No error (0)	tags.srv.stackadapt.com		3.225.21.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.377794027 CEST	1.1.1.1	192.168.2.5	0xfbe4	No error (0)	tags.srv.stackadapt.com		52.86.27.147	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.469235897 CEST	1.1.1.1	192.168.2.5	0x151d	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:12.469235897 CEST	1.1.1.1	192.168.2.5	0x151d	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.469235897 CEST	1.1.1.1	192.168.2.5	0x151d	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.469235897 CEST	1.1.1.1	192.168.2.5	0x151d	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.469235897 CEST	1.1.1.1	192.168.2.5	0x151d	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.469811916 CEST	1.1.1.1	192.168.2.5	0xef62	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:12.483364105 CEST	1.1.1.1	192.168.2.5	0x40a6	No error (0)	s.company-target.com	s.dsp-prod.demandbase.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:12.483364105 CEST	1.1.1.1	192.168.2.5	0x40a6	No error (0)	s.dsp-prod.demandbase.com		34.96.71.22	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.484405041 CEST	1.1.1.1	192.168.2.5	0xc51a	No error (0)	s.company-target.com	s.dsp-prod.demandbase.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:12.503896952 CEST	1.1.1.1	192.168.2.5	0x7599	No error (0)	api.company-target.com		13.35.116.97	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.503896952 CEST	1.1.1.1	192.168.2.5	0x7599	No error (0)	api.company-target.com		13.35.116.120	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.503896952 CEST	1.1.1.1	192.168.2.5	0x7599	No error (0)	api.company-target.com		13.35.116.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.503896952 CEST	1.1.1.1	192.168.2.5	0x7599	No error (0)	api.company-target.com		13.35.116.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:12.948616028 CEST	1.1.1.1	192.168.2.5	0x918	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:13:12.949206114 CEST	1.1.1.1	192.168.2.5	0x8629	No error (0)	www.google.com		142.250.217.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.151956081 CEST	1.1.1.1	192.168.2.5	0xd278	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.151956081 CEST	1.1.1.1	192.168.2.5	0xd278	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.151956081 CEST	1.1.1.1	192.168.2.5	0xd278	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.151956081 CEST	1.1.1.1	192.168.2.5	0xd278	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.151956081 CEST	1.1.1.1	192.168.2.5	0xd278	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.152003050 CEST	1.1.1.1	192.168.2.5	0x7e0b	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.152003050 CEST	1.1.1.1	192.168.2.5	0x7e0b	No error (0)	platform.twitter.map.fastly.net		146.75.124.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.152640104 CEST	1.1.1.1	192.168.2.5	0x379d	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.152651072 CEST	1.1.1.1	192.168.2.5	0xec0a	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.192240000 CEST	1.1.1.1	192.168.2.5	0x406a	No error (0)	a.quora.com	a.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.193387985 CEST	1.1.1.1	192.168.2.5	0x3c47	No error (0)	c.amazon-adsystem.com	d1ykf07e75w7ss.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.194032907 CEST	1.1.1.1	192.168.2.5	0x850c	No error (0)	a.quora.com	a.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.194057941 CEST	1.1.1.1	192.168.2.5	0xf76	No error (0)	c.amazon-adsystem.com	d1ykf07e75w7ss.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.194057941 CEST	1.1.1.1	192.168.2.5	0xf76	No error (0)	d1ykf07e75w7ss.cloudfront.net		18.239.228.142	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.207526922 CEST	1.1.1.1	192.168.2.5	0x9838	No error (0)	tag-logger.demandbase.com		13.32.87.20	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.207526922 CEST	1.1.1.1	192.168.2.5	0x9838	No error (0)	tag-logger.demandbase.com		13.32.87.74	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.207526922 CEST	1.1.1.1	192.168.2.5	0x9838	No error (0)	tag-logger.demandbase.com		13.32.87.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.207526922 CEST	1.1.1.1	192.168.2.5	0x9838	No error (0)	tag-logger.demandbase.com		13.32.87.128	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.215260983 CEST	1.1.1.1	192.168.2.5	0x98a4	No error (0)	api.company-target.com		13.35.116.97	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.215260983 CEST	1.1.1.1	192.168.2.5	0x98a4	No error (0)	api.company-target.com		13.35.116.120	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.215260983 CEST	1.1.1.1	192.168.2.5	0x98a4	No error (0)	api.company-target.com		13.35.116.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.215260983 CEST	1.1.1.1	192.168.2.5	0x98a4	No error (0)	api.company-target.com		13.35.116.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.311084032 CEST	1.1.1.1	192.168.2.5	0x9b72	No error (0)	dsum-sec.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.311084032 CEST	1.1.1.1	192.168.2.5	0x9b72	No error (0)	dsum-sec.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.311206102 CEST	1.1.1.1	192.168.2.5	0xa68d	No error (0)	dsum-sec.casalemedia.com			65	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners.tremorhub.com	partners-alb-1113315349.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		18.215.83.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		54.85.86.236	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		34.238.45.159	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		34.233.102.171	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		3.225.117.71	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		34.230.195.204	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		54.158.64.5	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.312169075 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		54.221.105.180	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.313112020 CEST	1.1.1.1	192.168.2.5	0xe077	No error (0)	partners.tremorhub.com	partners-alb-1113315349.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.314084053 CEST	1.1.1.1	192.168.2.5	0x57d0	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.315383911 CEST	1.1.1.1	192.168.2.5	0xb42f	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.531095028 CEST	1.1.1.1	192.168.2.5	0x8a6b	No error (0)	www.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.531095028 CEST	1.1.1.1	192.168.2.5	0x8a6b	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.532061100 CEST	1.1.1.1	192.168.2.5	0x98ba	No error (0)	www.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.532061100 CEST	1.1.1.1	192.168.2.5	0x98ba	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:13.583050013 CEST	1.1.1.1	192.168.2.5	0xcfa3	No error (0)	adservice.google.com		142.250.64.226	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.583327055 CEST	1.1.1.1	192.168.2.5	0x8b99	No error (0)	adservice.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:13:13.806349993 CEST	1.1.1.1	192.168.2.5	0x6bc9	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:13:13.806920052 CEST	1.1.1.1	192.168.2.5	0xfd07	No error (0)	www.google.com		192.178.50.68	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.853809118 CEST	1.1.1.1	192.168.2.5	0xcd16	No error (0)	aax-eu.amazon-adsystem.com		52.95.115.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.965691090 CEST	1.1.1.1	192.168.2.5	0x2ec0	No error (0)	q.quora.com		52.200.166.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.965691090 CEST	1.1.1.1	192.168.2.5	0x2ec0	No error (0)	q.quora.com		52.3.212.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.965691090 CEST	1.1.1.1	192.168.2.5	0x2ec0	No error (0)	q.quora.com		52.21.40.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.965691090 CEST	1.1.1.1	192.168.2.5	0x2ec0	No error (0)	q.quora.com		52.200.154.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.965691090 CEST	1.1.1.1	192.168.2.5	0x2ec0	No error (0)	q.quora.com		52.45.52.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.965955019 CEST	1.1.1.1	192.168.2.5	0xec4c	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:13.966362000 CEST	1.1.1.1	192.168.2.5	0xa665	No error (0)	ad.doubleclick.net		142.251.35.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.969167948 CEST	1.1.1.1	192.168.2.5	0x323a	No error (0)	tag-logger.demandbase.com		13.32.87.128	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.969167948 CEST	1.1.1.1	192.168.2.5	0x323a	No error (0)	tag-logger.demandbase.com		13.32.87.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.969167948 CEST	1.1.1.1	192.168.2.5	0x323a	No error (0)	tag-logger.demandbase.com		13.32.87.74	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:13.969167948 CEST	1.1.1.1	192.168.2.5	0x323a	No error (0)	tag-logger.demandbase.com		13.32.87.20	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.577287912 CEST	1.1.1.1	192.168.2.5	0x722f	No error (0)	q.quora.com		52.200.154.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.577287912 CEST	1.1.1.1	192.168.2.5	0x722f	No error (0)	q.quora.com		52.3.212.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.577287912 CEST	1.1.1.1	192.168.2.5	0x722f	No error (0)	q.quora.com		52.21.40.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.577287912 CEST	1.1.1.1	192.168.2.5	0x722f	No error (0)	q.quora.com		52.45.52.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.577287912 CEST	1.1.1.1	192.168.2.5	0x722f	No error (0)	q.quora.com		52.200.166.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.577374935 CEST	1.1.1.1	192.168.2.5	0xd89b	No error (0)	ad.doubleclick.net		142.250.64.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.578706980 CEST	1.1.1.1	192.168.2.5	0x9413	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:15.579384089 CEST	1.1.1.1	192.168.2.5	0x3f64	No error (0)	tag-logger.demandbase.com		13.32.87.20	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.579384089 CEST	1.1.1.1	192.168.2.5	0x3f64	No error (0)	tag-logger.demandbase.com		13.32.87.74	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.579384089 CEST	1.1.1.1	192.168.2.5	0x3f64	No error (0)	tag-logger.demandbase.com		13.32.87.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.579384089 CEST	1.1.1.1	192.168.2.5	0x3f64	No error (0)	tag-logger.demandbase.com		13.32.87.128	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.160.26	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.708782911 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850136042 CEST	1.1.1.1	192.168.2.5	0x4339	No error (0)	partners.tremorhub.com	partners-alb-1113315349.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners.tremorhub.com	partners-alb-1113315349.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		34.239.87.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		34.238.45.159	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		54.234.41.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		52.23.126.120	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		54.145.107.179	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		3.233.2.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		54.85.86.236	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.850853920 CEST	1.1.1.1	192.168.2.5	0x2d27	No error (0)	partners-alb-1113315349.us-east-1.elb.amazonaws.com		34.230.195.204	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:15.851243019 CEST	1.1.1.1	192.168.2.5	0x846	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:15.852369070 CEST	1.1.1.1	192.168.2.5	0xe93c	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:15.855397940 CEST	1.1.1.1	192.168.2.5	0x90a3	No error (0)	adservice.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:13:15.856168985 CEST	1.1.1.1	192.168.2.5	0xd764	No error (0)	adservice.google.com		192.178.50.66	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.355300903 CEST	1.1.1.1	192.168.2.5	0xdf25	No error (0)	rules.quantcount.com	d2fashanjl7d9f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.355300903 CEST	1.1.1.1	192.168.2.5	0xdf25	No error (0)	d2fashanjl7d9f.cloudfront.net		18.64.174.54	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.355300903 CEST	1.1.1.1	192.168.2.5	0xdf25	No error (0)	d2fashanjl7d9f.cloudfront.net		18.64.174.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.355300903 CEST	1.1.1.1	192.168.2.5	0xdf25	No error (0)	d2fashanjl7d9f.cloudfront.net		18.64.174.9	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.355300903 CEST	1.1.1.1	192.168.2.5	0xdf25	No error (0)	d2fashanjl7d9f.cloudfront.net		18.64.174.32	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.355331898 CEST	1.1.1.1	192.168.2.5	0xbca6	No error (0)	rules.quantcount.com	d2fashanjl7d9f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.438386917 CEST	1.1.1.1	192.168.2.5	0xa27	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:16.438559055 CEST	1.1.1.1	192.168.2.5	0x17	No error (0)	ad.doubleclick.net		142.250.189.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.440284967 CEST	1.1.1.1	192.168.2.5	0xdd57	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:16.440644979 CEST	1.1.1.1	192.168.2.5	0xd2c8	No error (0)	ad.doubleclick.net		192.178.50.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.441814899 CEST	1.1.1.1	192.168.2.5	0x3c84	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.441843033 CEST	1.1.1.1	192.168.2.5	0x1efb	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.441843033 CEST	1.1.1.1	192.168.2.5	0x1efb	No error (0)	spdc-global.pbp.gysm.yahoodns.net		76.13.32.146	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.442651987 CEST	1.1.1.1	192.168.2.5	0x6fd6	No error (0)	id.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.624034882 CEST	1.1.1.1	192.168.2.5	0x9c79	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.624223948 CEST	1.1.1.1	192.168.2.5	0x283c	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.624223948 CEST	1.1.1.1	192.168.2.5	0x283c	No error (0)	star-mini.c10r.facebook.com		157.240.14.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.642656088 CEST	1.1.1.1	192.168.2.5	0xf5b1	No error (0)	q.quora.com		52.3.212.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.642656088 CEST	1.1.1.1	192.168.2.5	0xf5b1	No error (0)	q.quora.com		52.45.52.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.642656088 CEST	1.1.1.1	192.168.2.5	0xf5b1	No error (0)	q.quora.com		52.200.154.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.642656088 CEST	1.1.1.1	192.168.2.5	0xf5b1	No error (0)	q.quora.com		52.200.166.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.642656088 CEST	1.1.1.1	192.168.2.5	0xf5b1	No error (0)	q.quora.com		52.21.40.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.642992973 CEST	1.1.1.1	192.168.2.5	0xd74c	No error (0)	dsum-sec.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.642992973 CEST	1.1.1.1	192.168.2.5	0xd74c	No error (0)	dsum-sec.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.643357038 CEST	1.1.1.1	192.168.2.5	0x9fcb	No error (0)	dsum-sec.casalemedia.com			65	IN (0x0001)	false
Apr 26, 2024 19:13:16.643413067 CEST	1.1.1.1	192.168.2.5	0x389f	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:16.643434048 CEST	1.1.1.1	192.168.2.5	0x2749	No error (0)	ad.doubleclick.net		142.250.64.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.160.114	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:16.644939899 CEST	1.1.1.1	192.168.2.5	0x9e23	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.288425922 CEST	1.1.1.1	192.168.2.5	0xe307	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.39	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.288425922 CEST	1.1.1.1	192.168.2.5	0xe307	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.288425922 CEST	1.1.1.1	192.168.2.5	0xe307	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.288425922 CEST	1.1.1.1	192.168.2.5	0xe307	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.288752079 CEST	1.1.1.1	192.168.2.5	0x2d20	No error (0)	aax-eu.amazon-adsystem.com		67.220.224.144	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.290900946 CEST	1.1.1.1	192.168.2.5	0x663b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.290900946 CEST	1.1.1.1	192.168.2.5	0x663b	No error (0)	star-mini.c10r.facebook.com		157.240.14.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.291368961 CEST	1.1.1.1	192.168.2.5	0xfbbd	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.309854984 CEST	1.1.1.1	192.168.2.5	0xcd4d	No error (0)	t.co		104.244.42.69	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.311640978 CEST	1.1.1.1	192.168.2.5	0x5d56	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.311640978 CEST	1.1.1.1	192.168.2.5	0x5d56	No error (0)	spdc-global.pbp.gysm.yahoodns.net		76.13.32.146	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.311902046 CEST	1.1.1.1	192.168.2.5	0x20dd	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.795530081 CEST	1.1.1.1	192.168.2.5	0xf55b	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.795530081 CEST	1.1.1.1	192.168.2.5	0xf55b	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.795530081 CEST	1.1.1.1	192.168.2.5	0xf55b	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.796386003 CEST	1.1.1.1	192.168.2.5	0x5e50	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.796386003 CEST	1.1.1.1	192.168.2.5	0x5e50	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.843915939 CEST	1.1.1.1	192.168.2.5	0x8a27	No error (0)	googleads.g.doubleclick.net		192.178.50.34	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.844093084 CEST	1.1.1.1	192.168.2.5	0xd67d	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:17.964689016 CEST	1.1.1.1	192.168.2.5	0x3b8f	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.965867996 CEST	1.1.1.1	192.168.2.5	0xd831	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:17.965867996 CEST	1.1.1.1	192.168.2.5	0xd831	No error (0)	global.px.quantserve.com		192.184.68.234	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.965867996 CEST	1.1.1.1	192.168.2.5	0xd831	No error (0)	global.px.quantserve.com		192.184.68.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.965867996 CEST	1.1.1.1	192.168.2.5	0xd831	No error (0)	global.px.quantserve.com		192.184.68.149	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.971046925 CEST	1.1.1.1	192.168.2.5	0xfb36	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.971046925 CEST	1.1.1.1	192.168.2.5	0xfb36	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.39	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.971046925 CEST	1.1.1.1	192.168.2.5	0xfb36	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.971046925 CEST	1.1.1.1	192.168.2.5	0xfb36	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.981957912 CEST	1.1.1.1	192.168.2.5	0xc63c	No error (0)	segments.company-target.com		13.35.116.64	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.981957912 CEST	1.1.1.1	192.168.2.5	0xc63c	No error (0)	segments.company-target.com		13.35.116.77	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.981957912 CEST	1.1.1.1	192.168.2.5	0xc63c	No error (0)	segments.company-target.com		13.35.116.51	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:17.981957912 CEST	1.1.1.1	192.168.2.5	0xc63c	No error (0)	segments.company-target.com		13.35.116.107	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.046469927 CEST	1.1.1.1	192.168.2.5	0xf962	No error (0)	t.co		104.244.42.197	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.610786915 CEST	1.1.1.1	192.168.2.5	0xfd52	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:18.610786915 CEST	1.1.1.1	192.168.2.5	0xfd52	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:18.610786915 CEST	1.1.1.1	192.168.2.5	0xfd52	No error (0)	s.twitter.com		104.244.42.67	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.611572981 CEST	1.1.1.1	192.168.2.5	0xd218	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:18.611572981 CEST	1.1.1.1	192.168.2.5	0xd218	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:18.670751095 CEST	1.1.1.1	192.168.2.5	0x35cf	No error (0)	segments.company-target.com		13.35.116.64	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.670751095 CEST	1.1.1.1	192.168.2.5	0x35cf	No error (0)	segments.company-target.com		13.35.116.51	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.670751095 CEST	1.1.1.1	192.168.2.5	0x35cf	No error (0)	segments.company-target.com		13.35.116.107	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.670751095 CEST	1.1.1.1	192.168.2.5	0x35cf	No error (0)	segments.company-target.com		13.35.116.77	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.951147079 CEST	1.1.1.1	192.168.2.5	0xadd5	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:18.951147079 CEST	1.1.1.1	192.168.2.5	0xadd5	No error (0)	global.px.quantserve.com		192.184.68.234	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.951147079 CEST	1.1.1.1	192.168.2.5	0xadd5	No error (0)	global.px.quantserve.com		192.184.68.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.951147079 CEST	1.1.1.1	192.168.2.5	0xadd5	No error (0)	global.px.quantserve.com		192.184.68.149	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:18.951889038 CEST	1.1.1.1	192.168.2.5	0xd5cc	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:19.500511885 CEST	1.1.1.1	192.168.2.5	0x5942	No error (0)	insight.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:19.500511885 CEST	1.1.1.1	192.168.2.5	0x5942	No error (0)	insight.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:19.500511885 CEST	1.1.1.1	192.168.2.5	0x5942	No error (0)	insight.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:19.500511885 CEST	1.1.1.1	192.168.2.5	0x5942	No error (0)	insight.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:20.405525923 CEST	1.1.1.1	192.168.2.5	0xf1f6	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:20.405525923 CEST	1.1.1.1	192.168.2.5	0xf1f6	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:20.405525923 CEST	1.1.1.1	192.168.2.5	0xf1f6	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:20.405525923 CEST	1.1.1.1	192.168.2.5	0xf1f6	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:22.437488079 CEST	1.1.1.1	192.168.2.5	0x8313	No error (0)	js.adsrvr.org	dg2iu7dxxehbo.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:22.437506914 CEST	1.1.1.1	192.168.2.5	0x9b94	No error (0)	js.adsrvr.org	dg2iu7dxxehbo.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:22.437506914 CEST	1.1.1.1	192.168.2.5	0x9b94	No error (0)	dg2iu7dxxehbo.cloudfront.net		18.64.168.121	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255624056 CEST	1.1.1.1	192.168.2.5	0x3573	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255624056 CEST	1.1.1.1	192.168.2.5	0x3573	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255624056 CEST	1.1.1.1	192.168.2.5	0x3573	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		18.204.189.243	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		18.214.95.166	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.225.139.162	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.210.17.65	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.216.52.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.167.155.45	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.147.4.223	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.255966902 CEST	1.1.1.1	192.168.2.5	0x913e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.205.1.199	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.261033058 CEST	1.1.1.1	192.168.2.5	0xd7c2	No error (0)	cm.g.doubleclick.net		192.178.50.34	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:23.265404940 CEST	1.1.1.1	192.168.2.5	0xfd77	No error (0)	tags.bluekai.com	tags.bluekai.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:23.265463114 CEST	1.1.1.1	192.168.2.5	0x4d65	No error (0)	tags.bluekai.com	tags.bluekai.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:32.615725994 CEST	1.1.1.1	192.168.2.5	0x8052	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.39.22	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.38.55	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.38.138	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.38.189	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.38.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.616327047 CEST	1.1.1.1	192.168.2.5	0xe328	No error (0)	adobetarget.data.adobedc.net		63.140.39.9	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:32.733160019 CEST	1.1.1.1	192.168.2.5	0xab1d	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:32.776922941 CEST	1.1.1.1	192.168.2.5	0x8a39	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:33.782578945 CEST	1.1.1.1	192.168.2.5	0xda3c	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:33.783082008 CEST	1.1.1.1	192.168.2.5	0x177b	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.39.82	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.39.93	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.38.217	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.39.150	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.38.112	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.39.248	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117238045 CEST	1.1.1.1	192.168.2.5	0x3e7	No error (0)	adobetarget.data.adobedc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.117619991 CEST	1.1.1.1	192.168.2.5	0x26f0	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:34.515898943 CEST	1.1.1.1	192.168.2.5	0x11d9	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:34.516876936 CEST	1.1.1.1	192.168.2.5	0xcffe	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:34.516876936 CEST	1.1.1.1	192.168.2.5	0xcffe	No error (0)	static-cdn.hotjar.com		108.157.173.85	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.516876936 CEST	1.1.1.1	192.168.2.5	0xcffe	No error (0)	static-cdn.hotjar.com		108.157.173.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.516876936 CEST	1.1.1.1	192.168.2.5	0xcffe	No error (0)	static-cdn.hotjar.com		108.157.173.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:34.516876936 CEST	1.1.1.1	192.168.2.5	0xcffe	No error (0)	static-cdn.hotjar.com		108.157.173.107	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:38.758687973 CEST	1.1.1.1	192.168.2.5	0x7250	No error (0)	ad.doubleclick.net		192.178.50.38	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:38.759437084 CEST	1.1.1.1	192.168.2.5	0x2c5	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:38.772922039 CEST	1.1.1.1	192.168.2.5	0xc8eb	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:38.773385048 CEST	1.1.1.1	192.168.2.5	0xfa60	No error (0)	ad.doubleclick.net		142.250.189.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:39.132237911 CEST	1.1.1.1	192.168.2.5	0xc90f	No error (0)	script.hotjar.com		13.226.52.60	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:39.132237911 CEST	1.1.1.1	192.168.2.5	0xc90f	No error (0)	script.hotjar.com		13.226.52.73	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:39.132237911 CEST	1.1.1.1	192.168.2.5	0xc90f	No error (0)	script.hotjar.com		13.226.52.120	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:39.132237911 CEST	1.1.1.1	192.168.2.5	0xc90f	No error (0)	script.hotjar.com		13.226.52.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:39.499810934 CEST	1.1.1.1	192.168.2.5	0x3c61	No error (0)	id.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184577942 CEST	1.1.1.1	192.168.2.5	0x28c8	No error (0)	ws.hotjar.com	wsky-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	ws.hotjar.com	wsky-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		52.50.39.109	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		54.154.154.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		52.208.124.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		63.32.142.159	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		52.16.23.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		54.76.186.139	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		54.154.74.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.184647083 CEST	1.1.1.1	192.168.2.5	0xc33e	No error (0)	wsky-live.live.eks.hotjar.com		52.18.20.246	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.231208086 CEST	1.1.1.1	192.168.2.5	0x744e	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:40.231266022 CEST	1.1.1.1	192.168.2.5	0xdcd4	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:40.231266022 CEST	1.1.1.1	192.168.2.5	0xdcd4	No error (0)	pacman-content-live.live.eks.hotjar.com		54.154.35.245	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.231266022 CEST	1.1.1.1	192.168.2.5	0xdcd4	No error (0)	pacman-content-live.live.eks.hotjar.com		99.80.149.126	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:40.231266022 CEST	1.1.1.1	192.168.2.5	0xdcd4	No error (0)	pacman-content-live.live.eks.hotjar.com		52.209.193.176	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:41.527760983 CEST	1.1.1.1	192.168.2.5	0x3f8c	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:41.528501987 CEST	1.1.1.1	192.168.2.5	0xde23	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:41.528501987 CEST	1.1.1.1	192.168.2.5	0xde23	No error (0)	pacman-content-live.live.eks.hotjar.com		54.154.35.245	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:41.528501987 CEST	1.1.1.1	192.168.2.5	0xde23	No error (0)	pacman-content-live.live.eks.hotjar.com		52.209.193.176	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:41.528501987 CEST	1.1.1.1	192.168.2.5	0xde23	No error (0)	pacman-content-live.live.eks.hotjar.com		99.80.149.126	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.26	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.114	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.083863020 CEST	1.1.1.1	192.168.2.5	0xe5ff	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:42.132026911 CEST	1.1.1.1	192.168.2.5	0x5c19	No error (0)	pixel.tapad.com		34.111.113.62	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	secure.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.160.114	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:44.398371935 CEST	1.1.1.1	192.168.2.5	0x193a	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:51.986924887 CEST	1.1.1.1	192.168.2.5	0x9d6f	No error (0)	ad.doubleclick.net		172.217.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:51.986973047 CEST	1.1.1.1	192.168.2.5	0x42ef	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:53.657634020 CEST	1.1.1.1	192.168.2.5	0xf186	No error (0)	ad.doubleclick.net		172.217.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:53.657671928 CEST	1.1.1.1	192.168.2.5	0x3ddd	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:53.665808916 CEST	1.1.1.1	192.168.2.5	0x2020	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:13:53.666933060 CEST	1.1.1.1	192.168.2.5	0x40d4	No error (0)	ad.doubleclick.net		192.178.50.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.168931007 CEST	1.1.1.1	192.168.2.5	0xef9e	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:56.169414043 CEST	1.1.1.1	192.168.2.5	0x49d7	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:56.169414043 CEST	1.1.1.1	192.168.2.5	0x49d7	No error (0)	d20qwf0wrdtevy.cloudfront.net		108.157.173.58	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.169414043 CEST	1.1.1.1	192.168.2.5	0x49d7	No error (0)	d20qwf0wrdtevy.cloudfront.net		108.157.173.64	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.169414043 CEST	1.1.1.1	192.168.2.5	0x49d7	No error (0)	d20qwf0wrdtevy.cloudfront.net		108.157.173.3	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.169414043 CEST	1.1.1.1	192.168.2.5	0x49d7	No error (0)	d20qwf0wrdtevy.cloudfront.net		108.157.173.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.203875065 CEST	1.1.1.1	192.168.2.5	0x3cb	No error (0)	secure-gl.imrworldwide.com	d8ghbpr3r4dzt.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:56.203875065 CEST	1.1.1.1	192.168.2.5	0x3cb	No error (0)	d8ghbpr3r4dzt.cloudfront.net		18.66.255.103	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.203875065 CEST	1.1.1.1	192.168.2.5	0x3cb	No error (0)	d8ghbpr3r4dzt.cloudfront.net		18.66.255.64	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.203875065 CEST	1.1.1.1	192.168.2.5	0x3cb	No error (0)	d8ghbpr3r4dzt.cloudfront.net		18.66.255.32	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.203875065 CEST	1.1.1.1	192.168.2.5	0x3cb	No error (0)	d8ghbpr3r4dzt.cloudfront.net		18.66.255.29	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.203999043 CEST	1.1.1.1	192.168.2.5	0x6e25	No error (0)	secure-gl.imrworldwide.com	d8ghbpr3r4dzt.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:56.828922987 CEST	1.1.1.1	192.168.2.5	0xc15b	No error (0)	d.agkn.com	data.agkn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:56.828922987 CEST	1.1.1.1	192.168.2.5	0xc15b	No error (0)	data.agkn.com	d2ctznuk6ro1vp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:56.828922987 CEST	1.1.1.1	192.168.2.5	0xc15b	No error (0)	d2ctznuk6ro1vp.cloudfront.net		18.239.225.85	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.828922987 CEST	1.1.1.1	192.168.2.5	0xc15b	No error (0)	d2ctznuk6ro1vp.cloudfront.net		18.239.225.15	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.828922987 CEST	1.1.1.1	192.168.2.5	0xc15b	No error (0)	d2ctznuk6ro1vp.cloudfront.net		18.239.225.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.828922987 CEST	1.1.1.1	192.168.2.5	0xc15b	No error (0)	d2ctznuk6ro1vp.cloudfront.net		18.239.225.16	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:13:56.829076052 CEST	1.1.1.1	192.168.2.5	0x5bec	No error (0)	d.agkn.com	data.agkn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:13:56.829076052 CEST	1.1.1.1	192.168.2.5	0x5bec	No error (0)	data.agkn.com	d2ctznuk6ro1vp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:10.793512106 CEST	1.1.1.1	192.168.2.5	0xd9c3	No error (0)	w3-reporting-nel.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:10.793512106 CEST	1.1.1.1	192.168.2.5	0xd9c3	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:10.793512106 CEST	1.1.1.1	192.168.2.5	0xd9c3	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:10.793512106 CEST	1.1.1.1	192.168.2.5	0xd9c3	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:10.793512106 CEST	1.1.1.1	192.168.2.5	0xd9c3	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:10.795181990 CEST	1.1.1.1	192.168.2.5	0x52cd	No error (0)	w3-reporting-nel.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:11.351326942 CEST	1.1.1.1	192.168.2.5	0xd12f	No error (0)	w3-reporting-nel.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:11.351326942 CEST	1.1.1.1	192.168.2.5	0xd12f	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:11.351326942 CEST	1.1.1.1	192.168.2.5	0xd12f	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:11.351326942 CEST	1.1.1.1	192.168.2.5	0xd12f	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:11.351326942 CEST	1.1.1.1	192.168.2.5	0xd12f	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:11.352976084 CEST	1.1.1.1	192.168.2.5	0xbf73	No error (0)	w3-reporting-nel.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.157757998 CEST	1.1.1.1	192.168.2.5	0xb645	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.159233093 CEST	1.1.1.1	192.168.2.5	0x6a81	No error (0)	s.go-mpulse.net	ip46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160156965 CEST	1.1.1.1	192.168.2.5	0xfec0	No error (0)	s.go-mpulse.net	ip46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.112	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.248	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.38.111	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.240	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.160718918 CEST	1.1.1.1	192.168.2.5	0x6586	No error (0)	xerolimited.sc.omtrdc.net		63.140.39.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.161155939 CEST	1.1.1.1	192.168.2.5	0x28f6	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.896939993 CEST	1.1.1.1	192.168.2.5	0xb15d	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.896939993 CEST	1.1.1.1	192.168.2.5	0xb15d	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.896939993 CEST	1.1.1.1	192.168.2.5	0xb15d	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.40.174.159	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.35.7.177	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		35.161.28.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.215.74.30	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		54.191.97.222	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		54.191.172.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		44.237.100.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:13.911953926 CEST	1.1.1.1	192.168.2.5	0x48ea	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.42.104.131	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:17.908292055 CEST	1.1.1.1	192.168.2.5	0x68e7	No error (0)	widget.trustpilot.com		13.249.98.6	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:17.908292055 CEST	1.1.1.1	192.168.2.5	0x68e7	No error (0)	widget.trustpilot.com		13.249.98.119	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:17.908292055 CEST	1.1.1.1	192.168.2.5	0x68e7	No error (0)	widget.trustpilot.com		13.249.98.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:17.908292055 CEST	1.1.1.1	192.168.2.5	0x68e7	No error (0)	widget.trustpilot.com		13.249.98.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.075606108 CEST	1.1.1.1	192.168.2.5	0x4d04	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.075606108 CEST	1.1.1.1	192.168.2.5	0x4d04	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.075831890 CEST	1.1.1.1	192.168.2.5	0xd1e2	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.075831890 CEST	1.1.1.1	192.168.2.5	0xd1e2	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.193.186.241	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.208.104.241	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.157.18.178	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.195.193.219	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.152.115.234	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.225.90.78	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.216.52.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.180943966 CEST	1.1.1.1	192.168.2.5	0xc51c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.215.251.248	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.181149006 CEST	1.1.1.1	192.168.2.5	0xfbf	No error (0)	xero.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.181149006 CEST	1.1.1.1	192.168.2.5	0xfbf	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.181149006 CEST	1.1.1.1	192.168.2.5	0xfbf	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.832153082 CEST	1.1.1.1	192.168.2.5	0xe41b	No error (0)	stats.g.doubleclick.net		172.217.204.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.832153082 CEST	1.1.1.1	192.168.2.5	0xe41b	No error (0)	stats.g.doubleclick.net		172.217.204.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.832153082 CEST	1.1.1.1	192.168.2.5	0xe41b	No error (0)	stats.g.doubleclick.net		172.217.204.154	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.832153082 CEST	1.1.1.1	192.168.2.5	0xe41b	No error (0)	stats.g.doubleclick.net		172.217.204.156	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.944426060 CEST	1.1.1.1	192.168.2.5	0x571	No error (0)	www.redditstatic.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.944426060 CEST	1.1.1.1	192.168.2.5	0x571	No error (0)	dualstack.reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.944426060 CEST	1.1.1.1	192.168.2.5	0x571	No error (0)	dualstack.reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.944426060 CEST	1.1.1.1	192.168.2.5	0x571	No error (0)	dualstack.reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.944426060 CEST	1.1.1.1	192.168.2.5	0x571	No error (0)	dualstack.reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.945909977 CEST	1.1.1.1	192.168.2.5	0x39b7	No error (0)	www.redditstatic.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:18.952503920 CEST	1.1.1.1	192.168.2.5	0x3919	No error (0)	tags.srv.stackadapt.com		18.210.82.4	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.952503920 CEST	1.1.1.1	192.168.2.5	0x3919	No error (0)	tags.srv.stackadapt.com		3.225.21.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.952503920 CEST	1.1.1.1	192.168.2.5	0x3919	No error (0)	tags.srv.stackadapt.com		52.86.27.147	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.952503920 CEST	1.1.1.1	192.168.2.5	0x3919	No error (0)	tags.srv.stackadapt.com		100.26.119.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.952503920 CEST	1.1.1.1	192.168.2.5	0x3919	No error (0)	tags.srv.stackadapt.com		18.210.31.191	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:18.952503920 CEST	1.1.1.1	192.168.2.5	0x3919	No error (0)	tags.srv.stackadapt.com		54.84.194.59	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.003179073 CEST	1.1.1.1	192.168.2.5	0x9a17	No error (0)	td.doubleclick.net		142.250.217.162	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.034425020 CEST	1.1.1.1	192.168.2.5	0x7a2e	No error (0)	9401320.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:19.040805101 CEST	1.1.1.1	192.168.2.5	0x2de4	No error (0)	9401320.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:19.040805101 CEST	1.1.1.1	192.168.2.5	0x2de4	No error (0)	dart.l.doubleclick.net		142.250.217.166	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.133445978 CEST	1.1.1.1	192.168.2.5	0x458c	No error (0)	js.adsrvr.org	dg2iu7dxxehbo.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:19.133445978 CEST	1.1.1.1	192.168.2.5	0x458c	No error (0)	dg2iu7dxxehbo.cloudfront.net		18.64.168.121	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.133486986 CEST	1.1.1.1	192.168.2.5	0xc604	No error (0)	js.adsrvr.org	dg2iu7dxxehbo.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:19.151191950 CEST	1.1.1.1	192.168.2.5	0xd542	No error (0)	api.company-target.com		13.35.116.97	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.151191950 CEST	1.1.1.1	192.168.2.5	0xd542	No error (0)	api.company-target.com		13.35.116.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.151191950 CEST	1.1.1.1	192.168.2.5	0xd542	No error (0)	api.company-target.com		13.35.116.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.151191950 CEST	1.1.1.1	192.168.2.5	0xd542	No error (0)	api.company-target.com		13.35.116.120	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.154023886 CEST	1.1.1.1	192.168.2.5	0x4ad2	No error (0)	s.company-target.com	s.dsp-prod.demandbase.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:19.154023886 CEST	1.1.1.1	192.168.2.5	0x4ad2	No error (0)	s.dsp-prod.demandbase.com		34.96.71.22	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.154059887 CEST	1.1.1.1	192.168.2.5	0x326d	No error (0)	s.company-target.com	s.dsp-prod.demandbase.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:19.754198074 CEST	1.1.1.1	192.168.2.5	0x7860	No error (0)	stats.g.doubleclick.net		173.194.213.154	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.754198074 CEST	1.1.1.1	192.168.2.5	0x7860	No error (0)	stats.g.doubleclick.net		173.194.213.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.754198074 CEST	1.1.1.1	192.168.2.5	0x7860	No error (0)	stats.g.doubleclick.net		173.194.213.156	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:19.754198074 CEST	1.1.1.1	192.168.2.5	0x7860	No error (0)	stats.g.doubleclick.net		173.194.213.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.412293911 CEST	1.1.1.1	192.168.2.5	0x4063	No error (0)	tag-logger.demandbase.com		13.32.87.128	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.412293911 CEST	1.1.1.1	192.168.2.5	0x4063	No error (0)	tag-logger.demandbase.com		13.32.87.74	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.412293911 CEST	1.1.1.1	192.168.2.5	0x4063	No error (0)	tag-logger.demandbase.com		13.32.87.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.412293911 CEST	1.1.1.1	192.168.2.5	0x4063	No error (0)	tag-logger.demandbase.com		13.32.87.20	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.512900114 CEST	1.1.1.1	192.168.2.5	0x9f07	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:21.512900114 CEST	1.1.1.1	192.168.2.5	0x9f07	No error (0)	platform.twitter.map.fastly.net		146.75.124.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.514040947 CEST	1.1.1.1	192.168.2.5	0x3219	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:21.580131054 CEST	1.1.1.1	192.168.2.5	0x360c	No error (0)	a.quora.com	a.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:21.581438065 CEST	1.1.1.1	192.168.2.5	0x54ff	No error (0)	a.quora.com	a.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:21.768475056 CEST	1.1.1.1	192.168.2.5	0x3938	No error (0)	api.company-target.com		13.35.116.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.768475056 CEST	1.1.1.1	192.168.2.5	0x3938	No error (0)	api.company-target.com		13.35.116.120	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.768475056 CEST	1.1.1.1	192.168.2.5	0x3938	No error (0)	api.company-target.com		13.35.116.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:21.768475056 CEST	1.1.1.1	192.168.2.5	0x3938	No error (0)	api.company-target.com		13.35.116.97	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.185378075 CEST	1.1.1.1	192.168.2.5	0xc334	No error (0)	tag-logger.demandbase.com		13.32.87.74	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.185378075 CEST	1.1.1.1	192.168.2.5	0xc334	No error (0)	tag-logger.demandbase.com		13.32.87.128	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.185378075 CEST	1.1.1.1	192.168.2.5	0xc334	No error (0)	tag-logger.demandbase.com		13.32.87.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.185378075 CEST	1.1.1.1	192.168.2.5	0xc334	No error (0)	tag-logger.demandbase.com		13.32.87.20	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.227102041 CEST	1.1.1.1	192.168.2.5	0x3bf2	No error (0)	aax-eu.amazon-adsystem.com		67.220.226.233	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.345913887 CEST	1.1.1.1	192.168.2.5	0x37f4	No error (0)	q.quora.com		52.200.166.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.345913887 CEST	1.1.1.1	192.168.2.5	0x37f4	No error (0)	q.quora.com		52.3.212.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.345913887 CEST	1.1.1.1	192.168.2.5	0x37f4	No error (0)	q.quora.com		52.200.154.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.345913887 CEST	1.1.1.1	192.168.2.5	0x37f4	No error (0)	q.quora.com		52.45.52.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.345913887 CEST	1.1.1.1	192.168.2.5	0x37f4	No error (0)	q.quora.com		52.21.40.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.160.26	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.350147963 CEST	1.1.1.1	192.168.2.5	0x9d96	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.359759092 CEST	1.1.1.1	192.168.2.5	0x9896	No error (0)	tags.srv.stackadapt.com		18.210.82.4	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.359759092 CEST	1.1.1.1	192.168.2.5	0x9896	No error (0)	tags.srv.stackadapt.com		52.86.27.147	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.359759092 CEST	1.1.1.1	192.168.2.5	0x9896	No error (0)	tags.srv.stackadapt.com		100.26.119.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.359759092 CEST	1.1.1.1	192.168.2.5	0x9896	No error (0)	tags.srv.stackadapt.com		18.210.31.191	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.359759092 CEST	1.1.1.1	192.168.2.5	0x9896	No error (0)	tags.srv.stackadapt.com		3.225.21.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:22.359759092 CEST	1.1.1.1	192.168.2.5	0x9896	No error (0)	tags.srv.stackadapt.com		54.84.194.59	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.125389099 CEST	1.1.1.1	192.168.2.5	0xdc91	No error (0)	id.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131146908 CEST	1.1.1.1	192.168.2.5	0x4000	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131146908 CEST	1.1.1.1	192.168.2.5	0x4000	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131146908 CEST	1.1.1.1	192.168.2.5	0x4000	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131146908 CEST	1.1.1.1	192.168.2.5	0x4000	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131146908 CEST	1.1.1.1	192.168.2.5	0x4000	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131421089 CEST	1.1.1.1	192.168.2.5	0xf875	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.160.114	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.131761074 CEST	1.1.1.1	192.168.2.5	0x12cb	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.133615971 CEST	1.1.1.1	192.168.2.5	0xe9bf	No error (0)	q.quora.com		52.200.166.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.133615971 CEST	1.1.1.1	192.168.2.5	0xe9bf	No error (0)	q.quora.com		52.3.212.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.133615971 CEST	1.1.1.1	192.168.2.5	0xe9bf	No error (0)	q.quora.com		52.200.154.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.133615971 CEST	1.1.1.1	192.168.2.5	0xe9bf	No error (0)	q.quora.com		52.21.40.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.133615971 CEST	1.1.1.1	192.168.2.5	0xe9bf	No error (0)	q.quora.com		52.45.52.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.148359060 CEST	1.1.1.1	192.168.2.5	0xc574	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:23.148550034 CEST	1.1.1.1	192.168.2.5	0x7931	No error (0)	ad.doubleclick.net		142.251.35.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.150696993 CEST	1.1.1.1	192.168.2.5	0x76f5	No error (0)	ad.doubleclick.net		142.250.64.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.151410103 CEST	1.1.1.1	192.168.2.5	0x5b30	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:23.520499945 CEST	1.1.1.1	192.168.2.5	0x4aad	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:23.520499945 CEST	1.1.1.1	192.168.2.5	0x4aad	No error (0)	star-mini.c10r.facebook.com		157.240.14.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.520545006 CEST	1.1.1.1	192.168.2.5	0x31a4	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:23.521838903 CEST	1.1.1.1	192.168.2.5	0x852	No error (0)	aax-eu.amazon-adsystem.com		52.94.222.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.522780895 CEST	1.1.1.1	192.168.2.5	0x15f2	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.522780895 CEST	1.1.1.1	192.168.2.5	0x15f2	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.522780895 CEST	1.1.1.1	192.168.2.5	0x15f2	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.522780895 CEST	1.1.1.1	192.168.2.5	0x15f2	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.39	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.823633909 CEST	1.1.1.1	192.168.2.5	0xc669	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:23.823633909 CEST	1.1.1.1	192.168.2.5	0xc669	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.823633909 CEST	1.1.1.1	192.168.2.5	0xc669	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.823633909 CEST	1.1.1.1	192.168.2.5	0xc669	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.823633909 CEST	1.1.1.1	192.168.2.5	0xc669	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:23.824656963 CEST	1.1.1.1	192.168.2.5	0x370b	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:24.077744007 CEST	1.1.1.1	192.168.2.5	0x8989	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:24.078293085 CEST	1.1.1.1	192.168.2.5	0x44da	No error (0)	ad.doubleclick.net		172.217.165.198	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.164048910 CEST	1.1.1.1	192.168.2.5	0x1f15	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:24.164048910 CEST	1.1.1.1	192.168.2.5	0x1f15	No error (0)	star-mini.c10r.facebook.com		157.240.14.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.164448977 CEST	1.1.1.1	192.168.2.5	0xad11	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:24.192945957 CEST	1.1.1.1	192.168.2.5	0x8e38	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:24.192945957 CEST	1.1.1.1	192.168.2.5	0x8e38	No error (0)	global.px.quantserve.com		192.184.68.149	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.192945957 CEST	1.1.1.1	192.168.2.5	0x8e38	No error (0)	global.px.quantserve.com		192.184.68.234	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.192945957 CEST	1.1.1.1	192.168.2.5	0x8e38	No error (0)	global.px.quantserve.com		192.184.68.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.192996025 CEST	1.1.1.1	192.168.2.5	0xb74a	No error (0)	t.co		104.244.42.133	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.193766117 CEST	1.1.1.1	192.168.2.5	0xe98c	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:24.198822021 CEST	1.1.1.1	192.168.2.5	0x5f97	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.198822021 CEST	1.1.1.1	192.168.2.5	0x5f97	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.198822021 CEST	1.1.1.1	192.168.2.5	0x5f97	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.39	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:24.198822021 CEST	1.1.1.1	192.168.2.5	0x5f97	No error (0)	ara.paa-reporting-advertising.amazon		18.173.166.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.007092953 CEST	1.1.1.1	192.168.2.5	0xf246	No error (0)	t.co		104.244.42.69	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.148868084 CEST	1.1.1.1	192.168.2.5	0x3380	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:25.149574995 CEST	1.1.1.1	192.168.2.5	0x727b	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:25.149574995 CEST	1.1.1.1	192.168.2.5	0x727b	No error (0)	global.px.quantserve.com		192.184.68.149	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.149574995 CEST	1.1.1.1	192.168.2.5	0x727b	No error (0)	global.px.quantserve.com		192.184.68.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.149574995 CEST	1.1.1.1	192.168.2.5	0x727b	No error (0)	global.px.quantserve.com		192.184.68.234	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.188024044 CEST	1.1.1.1	192.168.2.5	0x8d7c	No error (0)	nexus-websocket-a.intercom.io		34.237.73.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:25.188024044 CEST	1.1.1.1	192.168.2.5	0x8d7c	No error (0)	nexus-websocket-a.intercom.io		35.174.127.31	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.658092022 CEST	1.1.1.1	192.168.2.5	0x38b0	No error (0)	su.addthis.com	m.addthisedge.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:27.658092022 CEST	1.1.1.1	192.168.2.5	0x38b0	No error (0)	m.addthisedge.com	ds-m.addthisedge.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:27.676314116 CEST	1.1.1.1	192.168.2.5	0x4092	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:27.676314116 CEST	1.1.1.1	192.168.2.5	0x4092	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:27.678276062 CEST	1.1.1.1	192.168.2.5	0xb8d7	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:27.678276062 CEST	1.1.1.1	192.168.2.5	0xb8d7	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:27.687894106 CEST	1.1.1.1	192.168.2.5	0x3fbc	No error (0)	dmp.truoptik.com		104.17.127.254	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.687894106 CEST	1.1.1.1	192.168.2.5	0x3fbc	No error (0)	dmp.truoptik.com		104.16.192.58	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.687894106 CEST	1.1.1.1	192.168.2.5	0x3fbc	No error (0)	dmp.truoptik.com		104.17.111.254	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.687894106 CEST	1.1.1.1	192.168.2.5	0x3fbc	No error (0)	dmp.truoptik.com		104.17.208.58	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.687894106 CEST	1.1.1.1	192.168.2.5	0x3fbc	No error (0)	dmp.truoptik.com		104.18.80.52	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:27.688060999 CEST	1.1.1.1	192.168.2.5	0x239a	No error (0)	dmp.truoptik.com			65	IN (0x0001)	false
Apr 26, 2024 19:14:27.789038897 CEST	1.1.1.1	192.168.2.5	0x87fb	No error (0)	su.addthis.com	m.addthisedge.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:27.789038897 CEST	1.1.1.1	192.168.2.5	0x87fb	No error (0)	m.addthisedge.com	ds-m.addthisedge.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639472961 CEST	1.1.1.1	192.168.2.5	0xb9bf	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.39.93	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.38.217	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.39.150	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.38.112	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.39.248	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.639806986 CEST	1.1.1.1	192.168.2.5	0x2d1a	No error (0)	adobetarget.data.adobedc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:35.802767992 CEST	1.1.1.1	192.168.2.5	0xae4f	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:35.843422890 CEST	1.1.1.1	192.168.2.5	0x462d	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.39.93	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.38.217	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.39.150	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.39.248	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.602710962 CEST	1.1.1.1	192.168.2.5	0x9a2e	No error (0)	adobetarget.data.adobedc.net		63.140.38.112	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:36.607981920 CEST	1.1.1.1	192.168.2.5	0xdc1b	No error (0)	xerolimited.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:36.790477991 CEST	1.1.1.1	192.168.2.5	0xb97f	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:36.849735975 CEST	1.1.1.1	192.168.2.5	0x4489	No error (0)	user-tracking-api.dgt-digital-marketing.xero.com	user-tracking-api.dgt-digital-marketing.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:39.207676888 CEST	1.1.1.1	192.168.2.5	0x5f5c	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:39.207676888 CEST	1.1.1.1	192.168.2.5	0x5f5c	No error (0)	static-cdn.hotjar.com		108.157.173.76	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:39.207676888 CEST	1.1.1.1	192.168.2.5	0x5f5c	No error (0)	static-cdn.hotjar.com		108.157.173.85	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:39.207676888 CEST	1.1.1.1	192.168.2.5	0x5f5c	No error (0)	static-cdn.hotjar.com		108.157.173.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:39.207676888 CEST	1.1.1.1	192.168.2.5	0x5f5c	No error (0)	static-cdn.hotjar.com		108.157.173.107	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:39.209446907 CEST	1.1.1.1	192.168.2.5	0x238f	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:41.129067898 CEST	1.1.1.1	192.168.2.5	0xbdc3	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:41.129112005 CEST	1.1.1.1	192.168.2.5	0xf125	No error (0)	ad.doubleclick.net		142.250.189.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:41.619299889 CEST	1.1.1.1	192.168.2.5	0xa22a	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:41.619349003 CEST	1.1.1.1	192.168.2.5	0x6e5	No error (0)	ad.doubleclick.net		172.217.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:41.800499916 CEST	1.1.1.1	192.168.2.5	0x3b93	No error (0)	id.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	ws.hotjar.com	wsky-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		63.32.142.159	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		54.154.74.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		52.208.124.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		52.16.23.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		54.154.154.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		54.76.186.139	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		52.50.39.109	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.172995090 CEST	1.1.1.1	192.168.2.5	0x7a53	No error (0)	wsky-live.live.eks.hotjar.com		52.18.20.246	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.173022985 CEST	1.1.1.1	192.168.2.5	0x59a7	No error (0)	ws.hotjar.com	wsky-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:42.189760923 CEST	1.1.1.1	192.168.2.5	0x4b9	No error (0)	googleads.g.doubleclick.net		192.178.50.34	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.190474987 CEST	1.1.1.1	192.168.2.5	0x426	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:42.244915962 CEST	1.1.1.1	192.168.2.5	0xc7ec	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:42.244915962 CEST	1.1.1.1	192.168.2.5	0xc7ec	No error (0)	pacman-content-live.live.eks.hotjar.com		99.80.149.126	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.244915962 CEST	1.1.1.1	192.168.2.5	0xc7ec	No error (0)	pacman-content-live.live.eks.hotjar.com		54.154.35.245	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.244915962 CEST	1.1.1.1	192.168.2.5	0xc7ec	No error (0)	pacman-content-live.live.eks.hotjar.com		52.209.193.176	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.246815920 CEST	1.1.1.1	192.168.2.5	0x258b	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:42.989831924 CEST	1.1.1.1	192.168.2.5	0x2302	No error (0)	www.google.com		142.250.189.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:42.990601063 CEST	1.1.1.1	192.168.2.5	0xd551	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:14:43.508358002 CEST	1.1.1.1	192.168.2.5	0xdd8	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:43.508424997 CEST	1.1.1.1	192.168.2.5	0x60e6	No error (0)	content.hotjar.io	pacman-content-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:43.508424997 CEST	1.1.1.1	192.168.2.5	0x60e6	No error (0)	pacman-content-live.live.eks.hotjar.com		52.209.193.176	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:43.508424997 CEST	1.1.1.1	192.168.2.5	0x60e6	No error (0)	pacman-content-live.live.eks.hotjar.com		99.80.149.126	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:43.508424997 CEST	1.1.1.1	192.168.2.5	0x60e6	No error (0)	pacman-content-live.live.eks.hotjar.com		54.154.35.245	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.502850056 CEST	1.1.1.1	192.168.2.5	0x21bf	No error (0)	tags.rd.linksynergy.com	tags-cluster.rd.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:44.502850056 CEST	1.1.1.1	192.168.2.5	0x21bf	No error (0)	tags-cluster.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:44.502850056 CEST	1.1.1.1	192.168.2.5	0x21bf	No error (0)	ut.linksynergy.com		34.98.67.3	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.503350973 CEST	1.1.1.1	192.168.2.5	0x32b0	No error (0)	tags.rd.linksynergy.com	tags-cluster.rd.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:44.503350973 CEST	1.1.1.1	192.168.2.5	0x32b0	No error (0)	tags-cluster.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:44.503407955 CEST	1.1.1.1	192.168.2.5	0x5eaf	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:44.503407955 CEST	1.1.1.1	192.168.2.5	0x5eaf	No error (0)	uipus.semasio.net		50.57.31.206	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.504070044 CEST	1.1.1.1	192.168.2.5	0xf741	No error (0)	mid.rkdms.com		3.234.43.148	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.504070044 CEST	1.1.1.1	192.168.2.5	0xf741	No error (0)	mid.rkdms.com		52.204.71.73	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:44.504914999 CEST	1.1.1.1	192.168.2.5	0xd3e8	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:45.383641005 CEST	1.1.1.1	192.168.2.5	0xe63e	No error (0)	track2.securedvisit.com		54.234.5.56	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:45.383641005 CEST	1.1.1.1	192.168.2.5	0xe63e	No error (0)	track2.securedvisit.com		34.193.16.10	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:53.179487944 CEST	1.1.1.1	192.168.2.5	0xb8ae	No error (0)	ml314.com		34.117.77.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:53.199966908 CEST	1.1.1.1	192.168.2.5	0xe2d3	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:53.199966908 CEST	1.1.1.1	192.168.2.5	0xe2d3	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:53.199966908 CEST	1.1.1.1	192.168.2.5	0xe2d3	No error (0)	us-east-eb2.3lift.com		52.223.22.214	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:53.199966908 CEST	1.1.1.1	192.168.2.5	0xe2d3	No error (0)	us-east-eb2.3lift.com		35.71.139.29	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:53.200553894 CEST	1.1.1.1	192.168.2.5	0xc80d	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:53.200553894 CEST	1.1.1.1	192.168.2.5	0xc80d	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:54.347860098 CEST	1.1.1.1	192.168.2.5	0x1a9d	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:54.348309994 CEST	1.1.1.1	192.168.2.5	0x6f69	No error (0)	ad.doubleclick.net		172.217.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:54.349585056 CEST	1.1.1.1	192.168.2.5	0x9869	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:14:54.349844933 CEST	1.1.1.1	192.168.2.5	0x90e3	No error (0)	ad.doubleclick.net		142.251.35.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:57.361999989 CEST	1.1.1.1	192.168.2.5	0xfe8b	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:57.407224894 CEST	1.1.1.1	192.168.2.5	0xe4d0	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:14:57.708282948 CEST	1.1.1.1	192.168.2.5	0xce0a	No error (0)	tracking.g2crowd.com			65	IN (0x0001)	false
Apr 26, 2024 19:14:57.708424091 CEST	1.1.1.1	192.168.2.5	0x772c	No error (0)	tracking.g2crowd.com		172.64.144.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:14:57.708424091 CEST	1.1.1.1	192.168.2.5	0x772c	No error (0)	tracking.g2crowd.com		104.18.43.31	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:00.457029104 CEST	1.1.1.1	192.168.2.5	0x6466	No error (0)	www.google.com		142.250.64.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:00.457067013 CEST	1.1.1.1	192.168.2.5	0x3300	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:15:01.045244932 CEST	1.1.1.1	192.168.2.5	0x22c3	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:15:01.045394897 CEST	1.1.1.1	192.168.2.5	0x1a99	No error (0)	ad.doubleclick.net		172.217.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:01.119067907 CEST	1.1.1.1	192.168.2.5	0xf6a9	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 19:15:01.119606972 CEST	1.1.1.1	192.168.2.5	0x453	No error (0)	ad.doubleclick.net		172.217.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:02.157736063 CEST	1.1.1.1	192.168.2.5	0x2e1d	No error (0)	script.hotjar.com		13.226.52.120	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:02.157736063 CEST	1.1.1.1	192.168.2.5	0x2e1d	No error (0)	script.hotjar.com		13.226.52.73	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:02.157736063 CEST	1.1.1.1	192.168.2.5	0x2e1d	No error (0)	script.hotjar.com		13.226.52.60	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:02.157736063 CEST	1.1.1.1	192.168.2.5	0x2e1d	No error (0)	script.hotjar.com		13.226.52.129	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:05.493813992 CEST	1.1.1.1	192.168.2.5	0x7ad6	No error (0)	metrics.hotjar.io	pacman-metrics-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:05.493813992 CEST	1.1.1.1	192.168.2.5	0x7ad6	No error (0)	pacman-metrics-live.live.eks.hotjar.com		54.229.161.54	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:05.493813992 CEST	1.1.1.1	192.168.2.5	0x7ad6	No error (0)	pacman-metrics-live.live.eks.hotjar.com		52.48.182.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:05.493813992 CEST	1.1.1.1	192.168.2.5	0x7ad6	No error (0)	pacman-metrics-live.live.eks.hotjar.com		63.35.155.91	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:05.496273994 CEST	1.1.1.1	192.168.2.5	0x42d2	No error (0)	metrics.hotjar.io	pacman-metrics-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829466105 CEST	1.1.1.1	192.168.2.5	0x1eac	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		52.206.13.146	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		18.210.48.54	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		35.172.59.103	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		34.196.207.248	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		44.217.108.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		34.232.218.180	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		34.202.147.20	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.829725981 CEST	1.1.1.1	192.168.2.5	0x104b	No error (0)	match-us-east-1-ecs.sharethrough.com		3.210.60.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:09.896936893 CEST	1.1.1.1	192.168.2.5	0xd049	No error (0)	cw.addthis.com	m.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.896936893 CEST	1.1.1.1	192.168.2.5	0xd049	No error (0)	m.addthis.com	m.addthisedge.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.896936893 CEST	1.1.1.1	192.168.2.5	0xd049	No error (0)	m.addthisedge.com	ds-m.addthisedge.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.897381067 CEST	1.1.1.1	192.168.2.5	0x6f26	No error (0)	cw.addthis.com	m.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.897381067 CEST	1.1.1.1	192.168.2.5	0x6f26	No error (0)	m.addthis.com	m.addthisedge.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:09.897381067 CEST	1.1.1.1	192.168.2.5	0x6f26	No error (0)	m.addthisedge.com	ds-m.addthisedge.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:10.430195093 CEST	1.1.1.1	192.168.2.5	0x64ae	No error (0)	cm.g.doubleclick.net		192.178.50.66	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:11.338109016 CEST	1.1.1.1	192.168.2.5	0x6bac	No error (0)	w3-reporting-nel.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:11.338109016 CEST	1.1.1.1	192.168.2.5	0x6bac	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:11.338109016 CEST	1.1.1.1	192.168.2.5	0x6bac	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:11.338109016 CEST	1.1.1.1	192.168.2.5	0x6bac	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:11.338109016 CEST	1.1.1.1	192.168.2.5	0x6bac	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:11.339108944 CEST	1.1.1.1	192.168.2.5	0x6c0c	No error (0)	w3-reporting-nel.reddit.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:14.324001074 CEST	1.1.1.1	192.168.2.5	0xcf22	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:14.324857950 CEST	1.1.1.1	192.168.2.5	0x73a0	No error (0)	www.xero.com	www.xero.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:32.038827896 CEST	1.1.1.1	192.168.2.5	0x6880	No error (0)	q.quora.com		52.200.166.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:32.038827896 CEST	1.1.1.1	192.168.2.5	0x6880	No error (0)	q.quora.com		52.3.212.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:32.038827896 CEST	1.1.1.1	192.168.2.5	0x6880	No error (0)	q.quora.com		52.21.40.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:32.038827896 CEST	1.1.1.1	192.168.2.5	0x6880	No error (0)	q.quora.com		52.45.52.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:32.038827896 CEST	1.1.1.1	192.168.2.5	0x6880	No error (0)	q.quora.com		52.200.154.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:34.815118074 CEST	1.1.1.1	192.168.2.5	0xcf4c	No error (0)	q.quora.com		52.45.52.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:34.815118074 CEST	1.1.1.1	192.168.2.5	0xcf4c	No error (0)	q.quora.com		52.200.154.95	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:34.815118074 CEST	1.1.1.1	192.168.2.5	0xcf4c	No error (0)	q.quora.com		52.21.40.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:34.815118074 CEST	1.1.1.1	192.168.2.5	0xcf4c	No error (0)	q.quora.com		52.3.212.252	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:34.815118074 CEST	1.1.1.1	192.168.2.5	0xcf4c	No error (0)	q.quora.com		52.200.166.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.263345003 CEST	1.1.1.1	192.168.2.5	0xa48d	No error (0)	tags.srv.stackadapt.com		54.84.194.59	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.263345003 CEST	1.1.1.1	192.168.2.5	0xa48d	No error (0)	tags.srv.stackadapt.com		52.86.27.147	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.263345003 CEST	1.1.1.1	192.168.2.5	0xa48d	No error (0)	tags.srv.stackadapt.com		100.26.119.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.263345003 CEST	1.1.1.1	192.168.2.5	0xa48d	No error (0)	tags.srv.stackadapt.com		18.210.82.4	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.263345003 CEST	1.1.1.1	192.168.2.5	0xa48d	No error (0)	tags.srv.stackadapt.com		3.225.21.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:37.263345003 CEST	1.1.1.1	192.168.2.5	0xa48d	No error (0)	tags.srv.stackadapt.com		18.210.31.191	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.019732952 CEST	1.1.1.1	192.168.2.5	0xd36b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:38.019732952 CEST	1.1.1.1	192.168.2.5	0xd36b	No error (0)	star-mini.c10r.facebook.com		157.240.14.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.020394087 CEST	1.1.1.1	192.168.2.5	0x215c	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:38.029701948 CEST	1.1.1.1	192.168.2.5	0xcd67	No error (0)	stats.g.doubleclick.net		74.125.134.154	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.029701948 CEST	1.1.1.1	192.168.2.5	0xcd67	No error (0)	stats.g.doubleclick.net		74.125.134.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.029701948 CEST	1.1.1.1	192.168.2.5	0xcd67	No error (0)	stats.g.doubleclick.net		74.125.134.156	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.029701948 CEST	1.1.1.1	192.168.2.5	0xcd67	No error (0)	stats.g.doubleclick.net		74.125.134.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.038723946 CEST	1.1.1.1	192.168.2.5	0x7afc	No error (0)	tags.srv.stackadapt.com		18.210.31.191	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.038723946 CEST	1.1.1.1	192.168.2.5	0x7afc	No error (0)	tags.srv.stackadapt.com		18.210.82.4	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.038723946 CEST	1.1.1.1	192.168.2.5	0x7afc	No error (0)	tags.srv.stackadapt.com		54.84.194.59	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.038723946 CEST	1.1.1.1	192.168.2.5	0x7afc	No error (0)	tags.srv.stackadapt.com		52.86.27.147	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.038723946 CEST	1.1.1.1	192.168.2.5	0x7afc	No error (0)	tags.srv.stackadapt.com		100.26.119.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.038723946 CEST	1.1.1.1	192.168.2.5	0x7afc	No error (0)	tags.srv.stackadapt.com		3.225.21.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:38.667848110 CEST	1.1.1.1	192.168.2.5	0x3c6b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:38.668112040 CEST	1.1.1.1	192.168.2.5	0xce43	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:38.668112040 CEST	1.1.1.1	192.168.2.5	0xce43	No error (0)	star-mini.c10r.facebook.com		157.240.14.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.519462109 CEST	1.1.1.1	192.168.2.5	0xdab4	No error (0)	stats.g.doubleclick.net		172.217.204.155	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.519462109 CEST	1.1.1.1	192.168.2.5	0xdab4	No error (0)	stats.g.doubleclick.net		172.217.204.157	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.519462109 CEST	1.1.1.1	192.168.2.5	0xdab4	No error (0)	stats.g.doubleclick.net		172.217.204.156	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.519462109 CEST	1.1.1.1	192.168.2.5	0xdab4	No error (0)	stats.g.doubleclick.net		172.217.204.154	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.924112082 CEST	1.1.1.1	192.168.2.5	0x57d4	No error (0)	td.doubleclick.net		142.250.64.162	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.944668055 CEST	1.1.1.1	192.168.2.5	0x9525	No error (0)	940320.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:40.944668055 CEST	1.1.1.1	192.168.2.5	0x9525	No error (0)	dart.l.doubleclick.net		142.250.64.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:40.944717884 CEST	1.1.1.1	192.168.2.5	0x94ca	No error (0)	940320.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:43.242732048 CEST	1.1.1.1	192.168.2.5	0x61b1	No error (0)	ws.hotjar.com	wsky-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	ws.hotjar.com	wsky-live.live.eks.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		52.50.39.109	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		52.49.116.47	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		52.16.23.80	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		54.76.186.139	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		52.208.124.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		54.154.154.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		52.18.20.246	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.243469954 CEST	1.1.1.1	192.168.2.5	0x9347	No error (0)	wsky-live.live.eks.hotjar.com		54.154.74.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:15:43.343372107 CEST	1.1.1.1	192.168.2.5	0x84d1	No error (0)	adservice.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:15:43.343401909 CEST	1.1.1.1	192.168.2.5	0x244c	No error (0)	adservice.google.com		172.217.15.194	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 17:12:15 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=49890 Date: Fri, 26 Apr 2024 17:12:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 17:12:16 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=49883 Date: Fri, 26 Apr 2024 17:12:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 17:12:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	104.94.108.142	443	4512	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:19 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-04-26 17:12:19 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Fri, 26 Apr 2024 17:12:19 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Ko3zU8Hd5ZVTmFn&MD=l8GhsYuk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 17:12:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 821b3477-5f74-44ae-bc59-1a4f3e5d4306 MS-RequestId: 65e9ddda-85d8-45dc-9390-9b7c3ae555ca MS-CV: /CAu1M2IgUOvkoDe.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:12:26 GMT Connection: close Content-Length: 24490
2024-04-26 17:12:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 17:12:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49741	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:42 UTC	534	OUT	GET /nr-spa-1216.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:42 UTC	801	IN	HTTP/1.1 200 OK Connection: close Content-Length: 50049 x-amz-id-2: nBcsPl0guJQHd1N8k0GDWPaXerDP37FyqRHz0j+CxlV7qUT0VdbEto+SwAyKMOH8ppkTHbVF2Rc= x-amz-request-id: X3K9FSJV6SG9H1Q7 Last-Modified: Wed, 18 Oct 2023 21:31:16 GMT ETag: "63e2df852d15ab21d7ff8fc4363222e8" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: MElzWumrf8lREc3kORDlSWHVtEZAK4m8 Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:12:42 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760054-MIA X-Cache: HIT X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 6f 29 7b 69 66 28 21 6e 5b 65 5d 29 7b 69 66 28 21 74 5b 65 5d 29 7b 76 61 72 20 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 5f 5f 6e 72 5f 72 65 71 75 69 72 65 26 26 5f 5f 6e 72 5f 72 65 71 75 69 72 65 3b 69 66 28 21 6f 26 26 61 29 72 65 74 75 72 6e 20 61 28 65 2c 21 30 29 3b 69 66 28 69 29 72 65 74 75 72 6e 20 69 28 65 2c 21 30 29 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 7d 76 61 72 20 73 3d 6e 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 74 5b 65 5d 5b 30 5d 2e 63 61 6c 6c 28 73 2e 65 78 70 6f 72 74 73 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 Data Ascii: !function(t,n,e){function r(e,o){if(!n[e]){if(!t[e]){var a="function"==typeof __nr_require&&__nr_require;if(!o&&a)return a(e,!0);if(i)return i(e,!0);throw new Error("Cannot find module '"+e+"'")}var s=n[e]={exports:{}};t[e][0].call(s.exports,function(n){v
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 6e 3a 74 2c 6d 61 78 3a 74 2c 73 6f 73 3a 74 2a 74 2c 63 3a 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 2c 6e 2c 65 2c 72 29 7b 67 5b 74 5d 7c 7c 28 67 5b 74 5d 3d 7b 7d 29 3b 76 61 72 20 69 3d 67 5b 74 5d 5b 6e 5d 3b 72 65 74 75 72 6e 20 69 7c 7c 28 69 3d 67 5b 74 5d 5b 6e 5d 3d 7b 70 61 72 61 6d 73 3a 65 7c 7c 7b 7d 7d 2c 72 26 26 28 69 2e 63 75 73 74 6f 6d 3d 72 29 29 2c 69 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 3f 67 5b 74 5d 26 26 67 5b 74 5d 5b 6e 5d 3a 67 5b 74 5d 7d 66 75 6e 63 74 69 6f 6e 20 68 28 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 7b 7d 2c 65 3d 22 22 2c 72 3d 21 31 2c 69 3d 30 3b 69 3c 74 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 65 3d 74 5b 69 5d 2c 6e 5b 65 5d 3d 70 28 67 5b 65 5d 29 2c 6e 5b 65 5d 2e 6c 65 Data Ascii: n:t,max:t,sos:t*t,c:1}}function d(t,n,e,r){g[t]\|\|(g[t]={});var i=g[t][n];return i\|\|(i=g[t][n]={params:e\|\|{}},r&&(i.custom=r)),i}function l(t,n){return n?g[t]&&g[t][n]:g[t]}function h(t){for(var n={},e="",r=!1,i=0;i<t.length;i++)e=t[i],n[e]=p(g[e]),n[e].le
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 32 30 30 29 29 7d 76 61 72 20 64 3d 74 28 31 39 29 2c 6c 3d 74 28 31 30 29 2c 68 3d 74 28 32 29 2c 70 3d 74 28 32 31 29 2c 6d 3d 74 28 32 35 29 2c 76 3d 74 28 35 32 29 2c 67 3d 74 28 22 6c 6f 61 64 65 72 22 29 2c 79 3d 74 28 22 68 61 6e 64 6c 65 22 29 2c 78 3d 74 28 34 35 29 2c 77 3d 74 28 34 39 29 2c 62 3d 30 2c 54 3d 78 2e 67 65 74 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 28 22 73 73 6c 22 29 3d 3d 3d 21 31 3f 22 68 74 74 70 22 3a 22 68 74 74 70 73 22 3b 6c 2e 6f 6e 28 22 6a 73 65 72 72 6f 72 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 62 6f 64 79 3a 68 2e 74 61 6b 65 28 5b 22 63 6d 22 2c 22 73 6d 22 5d 29 7d 7d 29 2c 64 28 22 73 74 6f 72 65 4d 65 74 72 69 63 22 2c 72 2c 22 61 70 69 22 29 2c 64 28 22 73 74 6f 72 65 45 76 65 6e 74 4d 65 Data Ascii: 200))}var d=t(19),l=t(10),h=t(2),p=t(21),m=t(25),v=t(52),g=t("loader"),y=t("handle"),x=t(45),w=t(49),b=0,T=x.getConfiguration("ssl")===!1?"http":"https";l.on("jserrors",function(){return{body:h.take(["cm","sm"])}}),d("storeMetric",r,"api"),d("storeEventMe
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 2f 2c 69 3d 2f 28 5b 5e 3f 23 5d 2a 29 28 29 2e 2a 2f 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 6e 3f 72 3a 69 2c 22 24 31 24 32 22 29 7d 7d 2c 7b 7d 5d 2c 36 3a 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 6e 29 7b 76 61 72 20 65 3d 74 5b 31 5d 3b 6f 28 6e 5b 65 5d 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 76 61 72 20 72 3d 74 5b 30 5d 2c 69 3d 65 5b 30 5d 3b 69 66 28 69 3d 3d 3d 72 29 7b 76 61 72 20 6f 3d 65 5b 31 5d 2c 61 3d 74 5b 33 5d 2c 73 3d 74 5b 32 5d 3b 6f 2e 61 70 70 6c 79 28 61 2c 73 29 7d 7d 29 7d 76 61 72 20 69 3d 74 28 22 65 65 22 29 2c 6f 3d 74 28 35 32 29 2c 61 3d 74 28 31 39 29 2e 68 61 6e 64 6c 65 72 73 3b Data Ascii: /,i=/([^?#])()./;n.exports=function(t,n){return t.replace(n?r:i,"$1$2")}},{}],6:[function(t,n,e){function r(t,n){var e=t[1];o(n[e],function(n,e){var r=t[0],i=e[0];if(i===r){var o=e[1],a=t[3],s=t[2];o.apply(a,s)}})}var i=t("ee"),o=t(52),a=t(19).handlers;
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 74 75 72 65 22 29 29 7d 3b 76 61 72 20 61 3d 6e 2e 65 78 70 6f 72 74 73 2e 61 63 74 69 76 65 3d 7b 7d 7d 2c 7b 7d 5d 2c 39 3a 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 6e 2c 65 29 7b 74 68 69 73 2e 6c 6f 61 64 65 72 3d 74 2c 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 3d 6e 2c 74 68 69 73 2e 6f 70 74 73 3d 65 7c 7c 7b 7d 2c 74 68 69 73 2e 73 74 61 72 74 65 64 3d 21 31 2c 74 68 69 73 2e 74 69 6d 65 6f 75 74 48 61 6e 64 6c 65 3d 6e 75 6c 6c 7d 76 61 72 20 69 3d 74 28 31 30 29 2c 6f 3d 74 28 32 35 29 3b 6e 2e 65 78 70 6f 72 74 73 3d 72 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 54 69 6d 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 68 69 73 2e 69 6e 74 65 72 76 61 6c 3d 74 2c 74 68 69 73 2e 73 74 Data Ascii: ture"))};var a=n.exports.active={}},{}],9:[function(t,n,e){function r(t,n,e){this.loader=t,this.endpoint=n,this.opts=e\|\|{},this.started=!1,this.timeoutHandle=null}var i=t(10),o=t(25);n.exports=r,r.prototype.startTimer=function(t,n){this.interval=t,this.st
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 72 28 74 29 7b 69 66 28 74 2e 69 6e 66 6f 2e 62 65 61 63 6f 6e 29 7b 74 2e 69 6e 66 6f 2e 71 75 65 75 65 54 69 6d 65 26 26 53 2e 73 74 6f 72 65 28 22 6d 65 61 73 75 72 65 73 22 2c 22 71 74 22 2c 7b 76 61 6c 75 65 3a 74 2e 69 6e 66 6f 2e 71 75 65 75 65 54 69 6d 65 7d 29 2c 74 2e 69 6e 66 6f 2e 61 70 70 6c 69 63 61 74 69 6f 6e 54 69 6d 65 26 26 53 2e 73 74 6f 72 65 28 22 6d 65 61 73 75 72 65 73 22 2c 22 61 70 22 2c 7b 76 61 6c 75 65 3a 74 2e 69 6e 66 6f 2e 61 70 70 6c 69 63 61 74 69 6f 6e 54 69 6d 65 7d 29 2c 6a 2e 6d 65 61 73 75 72 65 28 22 62 65 22 2c 22 73 74 61 72 74 74 69 6d 65 22 2c 22 66 69 72 73 74 62 79 74 65 22 29 2c 6a 2e 6d 65 61 73 75 72 65 28 22 66 65 22 2c 22 66 69 72 73 74 62 79 74 65 22 2c 22 6f 6e 6c 6f 61 64 22 29 2c 6a 2e 6d 65 61 73 75 Data Ascii: r(t){if(t.info.beacon){t.info.queueTime&&S.store("measures","qt",{value:t.info.queueTime}),t.info.applicationTime&&S.store("measures","ap",{value:t.info.applicationTime}),j.measure("be","starttime","firstbyte"),j.measure("fe","firstbyte","onload"),j.measu
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 3d 73 3f 6e 75 6c 6c 3a 73 29 29 3b 76 61 72 20 75 3d 77 2e 66 72 6f 6d 41 72 72 61 79 28 69 2c 74 2e 6d 61 78 42 79 74 65 73 29 3b 54 2e 6a 73 6f 6e 70 28 49 2b 22 3a 2f 2f 22 2b 74 2e 69 6e 66 6f 2e 62 65 61 63 6f 6e 2b 22 2f 22 2b 72 2b 22 2f 22 2b 74 2e 69 6e 66 6f 2e 6c 69 63 65 6e 73 65 4b 65 79 2b 75 2c 55 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 76 61 72 20 6e 3d 79 28 4f 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 73 28 6e 2c 74 2c 7b 75 6e 6c 6f 61 64 3a 21 30 7d 29 7d 29 3b 72 65 74 75 72 6e 20 45 28 6e 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 7c 7c 6e 7d 66 75 6e 63 74 69 6f 6e 20 61 28 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 65 3d 76 28 29 2c 72 3d 76 28 29 2c 69 3d 4f 5b Data Ascii: =s?null:s));var u=w.fromArray(i,t.maxBytes);T.jsonp(I+"://"+t.info.beacon+"/"+r+"/"+t.info.licenseKey+u,U)}}}function i(t){var n=y(O,function(n){return s(n,t,{unload:!0})});return E(n,o)}function o(t,n){return t\|\|n}function a(t,n){for(var e=v(),r=v(),i=O[
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 65 2e 62 6f 64 79 2c 6e 2e 6d 61 78 42 79 74 65 73 29 29 29 2c 6c 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 2c 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 3b 76 61 72 20 65 2c 72 3b 69 66 28 6e 2e 6e 65 65 64 52 65 73 70 6f 6e 73 65 29 7b 69 66 28 21 5f 29 72 65 74 75 72 6e 21 31 3b 72 3d 21 30 2c 65 3d 54 2e 78 68 72 7d 65 6c 73 65 20 69 66 28 6e 2e 75 6e 6c 6f 61 64 29 72 3d 50 2c 65 3d 50 3f 54 2e 62 65 61 63 6f 6e 3a 54 2e 69 6d 67 3b 65 6c 73 65 20 69 66 28 5f 29 72 3d 21 30 2c 65 3d 54 2e 78 68 72 3b 65 6c 73 65 7b 69 66 28 22 65 76 65 6e 74 73 22 21 3d 3d 74 26 26 22 6a 73 65 72 72 6f 72 73 22 21 3d 3d 74 29 72 65 74 75 72 6e 21 31 3b 65 3d 54 2e 69 6d 67 7d 72 65 74 75 72 6e 7b 6d 65 74 68 6f 64 3a 65 2c 75 73 65 42 6f 64 79 3a 72 7d 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: e.body,n.maxBytes))),l}function d(t,n){n=n\|\|{};var e,r;if(n.needResponse){if(!_)return!1;r=!0,e=T.xhr}else if(n.unload)r=P,e=P?T.beacon:T.img;else if(_)r=!0,e=T.xhr;else{if("events"!==t&&"jserrors"!==t)return!1;e=T.img}return{method:e,useBody:r}}function
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 74 65 6e 65 72 73 3a 70 2c 67 65 74 53 75 62 6d 69 74 4d 65 74 68 6f 64 3a 64 7d 7d 2c 7b 7d 5d 2c 31 31 3a 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 72 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 37 5d 3e 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 38 5d 3e 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c Data Ascii: teners:p,getSubmitMethod:d}},{}],11:[function(t,n,e){var r=document.createElement("div");r.innerHTML="...[if lte IE 6]><div></div><![endif]-->...[if lte IE 7]><div></div><![endif]-->...[if lte IE 8]><div></div><![endif]-->...[if lte IE 9]><div></div><
2024-04-26 17:12:42 UTC	1378	IN	Data Raw: 74 69 6f 6e 20 72 28 74 2c 6e 29 7b 76 61 72 20 65 3d 74 5b 22 6e 61 76 69 67 61 74 69 6f 6e 22 2b 61 5d 3b 72 65 74 75 72 6e 20 6e 2e 6f 66 3d 65 2c 6f 28 65 2c 65 2c 6e 2c 22 6e 22 29 2c 6f 28 74 5b 75 2b 61 5d 2c 65 2c 6e 2c 22 75 22 29 2c 6f 28 74 5b 63 2b 61 5d 2c 65 2c 6e 2c 22 72 22 29 2c 6f 28 74 5b 75 2b 73 5d 2c 65 2c 6e 2c 22 75 65 22 29 2c 6f 28 74 5b 63 2b 73 5d 2c 65 2c 6e 2c 22 72 65 22 29 2c 6f 28 74 5b 22 66 65 74 63 68 22 2b 61 5d 2c 65 2c 6e 2c 22 66 22 29 2c 6f 28 74 5b 66 2b 61 5d 2c 65 2c 6e 2c 22 64 6e 22 29 2c 6f 28 74 5b 66 2b 73 5d 2c 65 2c 6e 2c 22 64 6e 65 22 29 2c 6f 28 74 5b 22 63 22 2b 64 2b 61 5d 2c 65 2c 6e 2c 22 63 22 29 2c 6f 28 74 5b 22 73 65 63 75 72 65 43 22 2b 64 2b 22 69 6f 6e 22 2b 61 5d 2c 65 2c 6e 2c 22 73 22 29 Data Ascii: tion r(t,n){var e=t["navigation"+a];return n.of=e,o(e,e,n,"n"),o(t[u+a],e,n,"u"),o(t[c+a],e,n,"r"),o(t[u+s],e,n,"ue"),o(t[c+s],e,n,"re"),o(t["fetch"+a],e,n,"f"),o(t[f+a],e,n,"dn"),o(t[f+s],e,n,"dne"),o(t["c"+d+a],e,n,"c"),o(t["secureC"+d+"ion"+a],e,n,"s")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49745	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:43 UTC	1080	OUT	GET /1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=8477&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1&be=3630&fe=7484&dc=7367&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1714151553247,%22n%22:0,%22r%22:20,%22re%22:1379,%22f%22:1379,%22dn%22:1381,%22dne%22:1381,%22c%22:1381,%22s%22:1382,%22ce%22:1637,%22rq%22:1637,%22rp%22:3277,%22rpe%22:3628,%22dl%22:3404,%22di%22:4943,%22ds%22:7367,%22de%22:7367,%22dc%22:7471,%22l%22:7471,%22le%22:7488%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=5463&jsonp=NREUM.setToken HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:43 UTC	495	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:12:43 GMT content-type: text/javascript cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * set-cookie: JSESSIONID=c1b656af79b55f04; Path=/; Domain=.nr-data.net; Secure; SameSite=None x-served-by: cache-mia-kmia1760088-MIA
2024-04-26 17:12:43 UTC	79	IN	Data Raw: 4e 52 45 55 4d 2e 73 65 74 54 6f 6b 65 6e 28 7b 27 73 74 6e 27 3a 30 2c 27 65 72 72 27 3a 31 2c 27 69 6e 73 27 3a 31 2c 27 73 70 61 27 3a 31 2c 27 73 72 27 3a 30 2c 27 73 72 73 27 3a 30 2c 27 73 74 27 3a 30 2c 27 73 74 73 27 3a 30 7d 29 Data Ascii: NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':0,'sts':0})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49747	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:43 UTC	777	OUT	POST /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=9267&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 204 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:12:43 UTC	204	OUT	Data Raw: 62 65 6c 2e 37 3b 31 2c 2c 2c 35 73 30 2c 35 73 30 2c 32 2c 27 69 6e 69 74 69 61 6c 50 61 67 65 4c 6f 61 64 2c 27 68 74 74 70 73 3a 2f 2f 69 6e 2e 78 65 72 6f 2e 63 6f 6d 2f 6d 2f 45 6e 31 4d 69 67 55 68 41 32 67 4a 78 53 50 75 78 31 47 43 34 68 44 77 6d 33 53 47 6c 50 4b 52 42 41 6e 44 57 44 4f 31 2c 31 2c 31 2c 2c 2c 21 21 21 21 27 61 32 36 36 61 62 66 34 2d 34 32 33 61 2d 34 66 38 39 2d 39 64 65 30 2d 65 33 37 32 34 65 33 62 64 66 66 37 2c 27 31 2c 34 37 72 2c 21 3b 62 2c 21 6b 2c 21 31 31 72 2c 2c 32 2c 2c 2c 31 2c 37 33 2c 2c 31 39 6b 2c 39 72 2c 2d 36 38 2c 31 36 72 2c 31 76 63 2c 2c 32 77 2c 2c 68 Data Ascii: bel.7;1,,,5s0,5s0,2,'initialPageLoad,'https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1,1,1,,,!!!!'a266abf4-423a-4f89-9de0-e3724e3bdff7,'1,47r,!;b,!k,!11r,,2,,,1,73,,19k,9r,-68,16r,1vc,,2w,,h
2024-04-26 17:12:44 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:12:43 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760065-MIA
2024-04-26 17:12:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49754	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:46 UTC	533	OUT	GET /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=9267&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:12:46 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:12:46 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760090-MIA
2024-04-26 17:12:46 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49762	13.32.87.102	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:49 UTC	520	OUT	GET /widget/ HTTP/1.1 Host: widget.intercom.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:49 UTC	727	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 2705 Connection: close Date: Fri, 26 Apr 2024 17:12:50 GMT Last-Modified: Fri, 26 Apr 2024 10:38:24 GMT ETag: "639100358138073092e32069f4cc78a8" x-amz-server-side-encryption: AES256 Cache-Control: max-age=300, s-maxage=300, public Content-Encoding: gzip x-amz-version-id: vs97S4BedNsv7Q9x_pC_kgUJuuP1DPYm Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 6bcc5cb16e0756268a257daab0f6082c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: IeaSSnsffDtTI4NOh6oV7njVAC4DoPFfBiU0ZYGTjW8kbCHtQ04Pbw== Cross-Origin-Resource-Policy: cross-origin Vary: Origin
2024-04-26 17:12:49 UTC	2705	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 59 0b 73 d3 3a 16 fe 2b 8e 77 27 b5 07 c5 49 4a 4b 8b 8b cb 96 52 2e 9d a5 c0 10 e6 ee dd 69 b3 19 c5 56 12 81 63 f9 ca 4a d3 dc 24 ff 7d 3f f9 15 3b 49 cb 65 06 06 5a fb e8 bc 74 74 1e 9f 4c 63 34 8b 7c c5 45 64 d9 cb 7b 2a 0d e6 2d 4f 5e 74 8f ba 6e 49 67 f6 92 39 ec 21 16 52 25 de 32 11 33 e9 b3 c1 94 c6 ae 39 e1 41 c0 a2 56 46 6a 81 64 12 1a f3 c1 90 26 0c 8b 4a c5 89 db 6e 83 d2 e2 74 ea f0 48 31 e9 0b 3c 08 93 c4 b3 61 c8 fd 41 4c d5 64 c3 f9 2d 29 99 fc 20 72 f0 ab 6d 92 64 c2 98 4a 06 b1 14 0f 8b 2d fe 82 b9 95 f1 a4 02 55 76 08 b3 48 c9 c5 5e e1 f9 7c 5e 5a 6b 49 a6 77 c7 a3 71 a6 23 95 82 fa 80 3d 38 13 35 0d 4d c2 a3 44 d1 30 1c 4c 45 c0 76 f6 17 6f f6 86 7f a5 d5 20 89 36 5c a3 e7 9d e3 80 bd 78 e9 53 ff c5 11 Data Ascii: Ys:+w'IJKR.iVcJ$}?;IeZttLc4\|Ed{*-O^tnIg9!R%239AVFjd&JntH1<aALd-) rmdJ-UvH^\|^ZkIwq#=85MD0LEvo 6\xS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49766	13.226.52.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:50 UTC	506	OUT	GET /frame-modern.e1eb984e.js HTTP/1.1 Host: js.intercomcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:50 UTC	793	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 145072 Connection: close Date: Fri, 26 Apr 2024 17:12:51 GMT Last-Modified: Fri, 26 Apr 2024 10:35:28 GMT ETag: "d8bf3af29257e33695b238d38ec1fba0" x-amz-server-side-encryption: AES256 Cache-Control: max-age=31536000, s-maxage=7200, public Content-Encoding: gzip x-amz-version-id: lMQ15q7R7OjAt4ub0sGpdmBCVPa4AVTO Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 8a771ca27e5a3c9e06b12b7af5d25aa4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: JmNgr_K82H0qfii-kjvVF7ZNURU95AGICgojodupN_r09T__hyWtPg== Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cross-Origin-Resource-Policy: cross-origin
2024-04-26 17:12:50 UTC	15591	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 07 7b db 48 b6 20 fa 57 28 5e 3f 5d 60 ba 04 31 29 90 1a b6 56 c9 96 6c 25 2b d8 b2 bd 5e 1a 24 8b 22 2c 10 a0 01 90 34 2d f1 bf ef 39 a7 aa 80 42 a0 e4 ee 99 7b 77 df fb de 37 d3 32 88 50 f1 d4 c9 c1 30 cc f6 9f 8f 53 3b 28 71 16 b1 80 79 cc 61 7e fb 71 ab 5e ab 57 5a 06 dd 53 2f 78 ed c7 b2 b5 3e b0 1d 97 f7 ad d1 b8 5e 6e d5 6b db 9b 75 06 37 3d 3f 72 06 4e cf 8e 1c df 13 8f 9a cd 7a a3 8a 8f fc 31 0f ec c8 0f e4 17 db b5 46 03 6f 87 93 ee c8 89 c4 cd 46 a3 ba b1 b9 d8 19 4c bc 1e 36 50 72 0c 6e 52 8f 51 db 87 cb 9d 80 47 93 c0 2b 05 46 64 2e e2 97 f0 c9 a3 33 30 56 02 cb 37 3c c6 4d f5 89 c7 67 a5 a3 20 f0 03 a3 7c 60 7b 30 b2 d2 c0 f1 fa a5 91 df 9f b8 bc f4 9f e5 3f f8 1f e5 ff 2c 9b 3b d1 30 f0 67 a5 c8 ea f9 7d Data Ascii: {H W(^?]`1)Vl%+^$",4-9B{w72P0S;(qya~q^WZS/x>^nku7=?rNz1FoFL6PrnRQG+Fd.30V7<Mg \|`{0?,;0g}
2024-04-26 17:12:50 UTC	1260	IN	Data Raw: b7 64 0e d9 f3 b9 34 3d 5d 57 a4 e9 e9 e6 50 66 8c bd 99 c8 8c b5 b7 d7 d2 4e 15 44 b2 32 f2 64 28 ad 52 53 57 5a a5 64 7a d9 39 fb f9 e1 f7 ea 17 27 b5 35 36 b7 2a 48 3e ed e4 e0 f5 88 28 d6 b6 aa 82 3e d6 2a b5 ad 86 10 0f 44 d1 62 94 0e 64 79 62 94 0e 64 d1 e2 61 c2 f1 4f db 71 79 62 dd a9 f0 ff c3 d9 5b 47 ff 25 e9 24 07 bf 93 4e f2 fe bf 37 9d e4 e0 bf 35 9d a4 1e e5 f1 ff a7 c7 fd 7f 41 7a dc 79 96 65 b0 ad fd cd 3e f0 68 c0 8e ce 53 ba c0 6e 5e 8f 64 5b c7 db 6f 18 c9 be ca 79 2d 88 13 34 64 2d 83 d9 a0 6d db 9a 9c fd 90 1d d1 a7 61 c4 c7 14 08 4a 61 00 32 1b 5c 08 5b 95 8a 23 ce 95 49 00 79 ac f1 2b 35 88 e7 6a de db d6 fd a7 bb 65 6f e7 ec 2d b6 f5 ba ef 6b 63 4c 59 5b 72 ef 3e bc fb 5c fc ee d1 6f 1b e9 42 eb 44 18 e9 a4 9d e0 68 83 7e 15 94 f2 Data Ascii: d4=]WPfND2d(RSWZdz9'56H>(>DbdybdaOqyb[G%$N75Azye>hSn^d[oy-4d-maJa2\[#Iy+5jeo-kcLY[r>\oBDh~
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: f4 e5 6b c2 ac 4d cc af 4c c7 81 2d 64 e4 35 de 2e 8e 1b a6 c5 b9 2e 04 c3 d2 10 ce 2d d5 72 97 b9 d2 c5 0b fa 36 79 70 ee c8 3b d7 18 8b 0c 49 b1 f7 c4 72 48 c1 18 9d 42 38 c1 e4 d8 25 95 a1 4d 87 11 82 87 39 30 ed 99 b4 d0 a9 b8 bb b8 26 b5 02 6e bd 26 b5 dc e7 a2 6a d4 d3 ff e2 6a d4 31 c9 16 5a 8c 18 19 21 39 11 8f 24 33 c4 fb 1d 54 53 63 79 69 51 d7 d8 d3 dd 23 fa 56 88 ca 1d 4a 42 e2 b5 3d dc ed 1d 2f a9 5d 66 fe b9 56 dd cd 6d 68 b6 c6 35 6e a8 2d eb ce d3 c6 c6 5d ab 3a d5 aa d8 7c 64 77 b1 c8 fc 8b 2d 2e ab 9a 7d 09 bc c1 38 5f 35 9b 79 a2 0c 39 70 fb 38 a1 10 27 c4 32 e5 a8 29 67 1d d6 f0 4c f6 52 2f b0 2d b7 b2 a0 ba b6 9e ff 3b 0f 1a e8 a9 ba 0c 3c 28 73 d6 12 20 71 fe 3b 80 84 06 a0 83 8a aa 88 7c 70 9c f4 1b 14 f4 1b 24 fd 06 a2 18 62 a6 df Data Ascii: kML-d5..-r6yp;IrHB8%M90&n&jj1Z!9$3TScyiQ#VJB=/]fVmh5n-]:\|dw-.}8_5y9p8'2)gLR/-;<(s q;\|p$b
2024-04-26 17:12:50 UTC	1024	IN	Data Raw: 97 ab b1 2e 71 f2 29 a8 92 98 eb 3f 1e 40 06 73 2a f0 f7 fd aa b5 23 63 9e 3b 03 03 87 ab af be 3a a7 83 ff 74 7d 5f 5d 3b a7 ce 95 38 98 43 f7 c4 f9 94 15 e8 6b e5 ac bf a4 e5 1a 6d 64 aa db 6e c6 36 17 8e 2a b7 e8 9e 5b 56 0e e0 b4 86 5b bb c0 93 0d 30 9a 6a 81 b7 a8 3e ac 19 b9 28 02 7e 28 04 fc e9 64 76 9c 4f aa 4b 54 74 75 f0 ec cd e5 83 ea 1a ba 51 05 b2 93 4d 20 3b 35 40 46 24 c9 46 77 a1 03 e9 5c 95 ea c3 6c 27 64 80 b0 5c 22 1b 12 af b4 cb 4c 4b a5 6f ee 88 f3 2a da 47 82 de c6 75 4a 4b dd fc 86 2b 87 c1 6d b6 1a 93 d2 10 63 a5 b5 e6 21 e4 67 5d f5 39 f5 03 08 fd 88 e3 9f 49 70 e5 ee 79 4f e9 f0 31 dc c1 af b1 0a f1 4d b5 8d 18 c9 98 6d 74 d1 bb 87 4d 93 be 4e a9 b1 6a 32 70 2b fb 95 f7 84 6c 5a 02 3f e7 dc 19 b5 0c 7e 00 04 5d b8 e5 40 7a 43 6b Data Ascii: .q)?@s#c;:t}_];8Ckmdn6[V[0j>(~(dvOKTtuQM ;5@F$Fw\l'd\"LKo*GuJK+mc!g]9IpyO1MmtMNj2p+lZ?~]@zCk
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: b2 52 39 af 0e c3 c9 7a ed 1c 2f 4f e9 3a c1 4f 2e db 22 60 29 55 9e 38 c6 e5 0b 49 db c6 b4 e6 75 c5 de f4 68 75 0e 65 e5 e1 23 11 1e ac 1f 56 68 d2 18 fb a3 32 83 a6 24 20 b0 d6 0f 7e 58 9c cc e6 55 ca 7e 5a d1 91 51 db bb 2f 9f 69 2a c6 d0 30 3a d6 45 35 be 87 c2 5d 2f cf d8 1e 54 5e f4 4f f9 4d 4b db f9 3e 5d 21 77 52 3c d9 54 d2 02 e0 2a 5b df 33 55 aa 5f a7 ac e5 c0 dd ea 1e f3 2e 72 4d 37 15 3d ab bc cc 32 53 2f db 47 4f aa 92 a5 33 e1 05 37 06 4f 6d 9e 60 ab 00 05 7e 55 38 ac 9e b2 d1 e2 d0 a4 bd a5 3e cc ef 2a 1c 82 3e db 96 c3 bc 46 be 33 ad 3f ae 61 8d 88 0a b4 02 68 c9 c8 80 16 32 7e 2b ca 90 14 c6 7e bc 2c b9 84 f7 89 ea 51 3f b7 8e fa b9 39 ea e7 b5 1f 97 41 54 ab 82 c4 9d 7a e3 93 d6 56 bb f9 fb 1f 46 eb 0b 5f 6c 2e fc e7 30 f4 cf 07 03 5a Data Ascii: R9z/O:O."`)U8Iuhue#Vh2$ ~XU~ZQ/i0:E5]/T^OMK>]!wR<T[3U_.rM7=2S/GO37Om`~U8>*>F3?ah2~+~,Q?9ATzVF_l.0Z
2024-04-26 17:12:50 UTC	1024	IN	Data Raw: b7 e3 3b cf ed 96 e3 3e 4e a1 c7 42 87 61 12 e4 1e 84 71 5e 6c f4 24 21 5b e3 50 dd d5 e3 1e 8e 63 62 e9 35 4a 67 f2 47 de 85 fc 0e 1a 4d 41 e5 1b e8 e9 ca 87 95 6c 54 9e 72 3b d0 c9 f7 3b a5 48 19 a7 a9 ef 47 af 78 56 73 f6 6e a3 5c dc 08 c5 11 32 3a 0b bc c3 90 ef 24 91 b1 b7 56 aa 11 42 55 99 06 73 c0 30 03 cf 0e a1 92 27 f2 b4 72 42 a6 f5 22 62 50 e1 13 1f e7 0b 47 ab 91 f5 30 7f 47 3e d4 83 d2 b7 20 df bd 10 0e 46 70 a8 c4 03 3e 88 7c 98 a3 21 42 03 9c 59 86 ec a1 64 6d 6a 60 57 e7 01 13 07 b1 3f f1 39 0c b9 4f f3 91 8b c5 71 60 ce 22 81 06 3a d7 62 51 ce 0e d4 5f c5 05 c0 4e cf e7 48 07 d5 ef 58 bf 30 6c 83 08 f2 39 14 8b fe c2 17 42 3f 89 c5 1b b1 fc d1 9f f8 e2 80 65 a3 19 9e 30 68 33 86 21 6e 3a 21 14 05 07 c1 3c 07 9a 48 a5 5a 74 5e 0e 78 f5 5d Data Ascii: ;>NBaq^l$![Pcb5JgGMAlTr;;HGxVsn\2:$VBUs0'rB"bPG0G> Fp>\|!BYdmj`W?9Oq`":bQ_NHX0l9B?e0h3!n:!<HZt^x]
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: a7 e8 53 42 a2 9a 58 24 10 6b 8f 55 e6 28 88 d9 5b c0 63 b1 61 54 5e 7a be f9 0c e2 18 12 df 97 2b 08 cf 75 78 02 d9 97 f4 02 e9 5b 88 4e 84 35 51 9c 19 0c 11 b9 10 f0 34 f0 e4 12 22 72 9f b9 9a d0 33 94 9c cb b3 40 95 d7 ca 1f 4e 2d 3c 3a b0 f0 e8 e0 a6 e2 d1 c1 7a 3c fa b8 06 8f 0e ae 75 0f 3d 05 1e 9d 7e 1d 1e 89 f8 01 28 e3 c3 06 24 44 de 10 80 8f 46 10 68 5e 75 d0 b6 ca 4b 21 54 ac e9 76 21 7d 22 80 67 49 30 82 51 5a 86 f1 e2 91 18 81 7b 4a b6 50 5d d5 e4 af bc 85 38 4f 01 32 d4 b1 59 49 80 b4 08 08 b7 0a 37 86 28 48 89 05 43 1c 0a 9d 87 b7 0c c1 d9 b5 00 a2 68 4a 02 56 09 7e b2 88 cc 0b 34 86 85 94 0d 5e 52 0e 8b 13 4f 46 5a d3 3b 0a 51 ae 72 c1 33 2c 56 11 ed 21 88 4e 20 fc dc 5a 7c 55 63 5c 9c 53 a6 8b 24 7a 1e 3b 43 10 95 2c c8 86 84 ae 9c dc c0 Data Ascii: SBX$kU([caT^z+ux[N5Q4"r3@N-<:z<u=~($DFh^uK!Tv!}"gI0QZ{JP]8O2YI7(HChJV~4^ROFZ;Qr3,V!N Z\|Uc\S$z;C,
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: 8b c4 9a 91 a8 2a 78 d8 12 35 97 b0 9c 8b 8e e4 5d 85 c4 91 89 10 4a 3a f4 40 47 2b 3e 1b 15 04 6a 6c 8c 28 f7 d0 de 47 7c 46 4a 7d 0f b2 5e 10 83 dc 1c 68 41 02 e8 4e de 1b 6c 18 e1 71 c1 87 ac 17 69 d6 2e ca 18 8d 29 2c 9d 47 f1 5f e6 68 be 9d 25 7e 0e 33 ae 65 75 ef 2e 1c 44 c2 07 5d 61 c5 46 5b d9 09 ec 52 75 0a 8b 2e 8e f2 96 7b 43 87 a0 90 c1 de 84 f8 97 17 d3 0e 02 21 37 32 78 06 a0 a0 74 50 09 57 c8 b1 78 e3 21 08 27 8d e4 53 49 35 72 61 1c 20 70 af de 0f d3 a4 96 7b bb 81 05 c2 fe 9a b0 40 98 13 5a 06 70 45 01 41 c2 2e dc f8 53 86 41 25 0e 96 9d ab 5d d0 ed d1 16 16 cb 78 b7 21 bf 8c 91 b9 b9 a1 fa b2 7d 27 5d 8d 31 71 98 78 1a 18 73 3e 66 aa 99 1e 0c 8f 63 93 5e 94 8e 72 e3 05 e5 1f 7d ba 5b 24 51 a4 eb fa 45 89 59 2c 91 3b 6d e6 0b 4b 64 f7 db Data Ascii: *x5]J:@G+>jl(G\|FJ}^hANlqi.),G_h%~3eu.D]aF[Ru.{C!72xtPWx!'SI5ra p{@ZpEA.SA%]x!}']1qxs>fc^r}[$QEY,;mKd
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: 16 93 4a 51 db 28 43 b6 fe 30 a3 5c 92 17 a3 d0 3f 0d 59 00 7c 8c 51 a8 00 63 19 30 45 89 d6 b2 69 58 02 66 2f d1 1b 5e a3 bd 1a f2 54 1e 7b a2 b0 4c 61 a5 b1 5a 8b 48 76 05 13 c5 51 81 65 c3 21 24 69 af 3e bc 54 3a 2f fe b9 eb b9 91 6a 55 7c d6 a2 e0 71 58 3b 2e a2 6e 28 df 57 70 77 57 b5 46 89 0f 6f 8d 81 d2 55 97 38 27 e4 38 e4 43 39 5d d3 be 55 ec 6f 48 31 f5 f1 be 09 91 0a 7f 00 8f 1a 81 08 48 f1 f4 47 12 0c 3d 82 a7 0f db cb 32 5b 35 97 86 22 b4 fa 15 8f 27 c0 2b a7 b0 5b ce 3f d0 b9 1e 86 76 4e 54 80 b3 cc 98 90 db 72 6a a1 61 46 1a 3c 6f a8 51 8c 87 a1 81 7a d9 6b a0 77 65 c2 32 b2 d2 48 65 e1 45 12 7f 7d 6b 4e 70 c7 0d 61 5a 3c 9e 61 59 ff 6e 66 86 2e 6c 64 d7 fa ab 34 a2 64 55 d6 5e ab 1d de fd 33 0a af 5a 6d 75 b9 c8 58 e1 dd 03 21 c7 0e 37 04 Data Ascii: JQ(C0\?Y\|Qc0EiXf/^T{LaZHvQe!$i>T:/jU\|qX;.n(WpwWFoU8'8C9]UoH1HG=2[5"'+[?vNTrjaF<oQzkwe2HeE}kNpaZ<aYnf.ld4dU^3ZmuX!7
2024-04-26 17:12:50 UTC	3072	IN	Data Raw: dd 44 6e 3b 7c 25 d3 fb 68 b2 98 76 e9 af 7d 6f cc f7 c8 7e ed 35 e8 f8 92 61 a9 70 e1 c4 4d 58 a4 ee bf 4a e2 9b d9 92 55 b4 7a 71 00 0f 5c 1e a3 ee c8 0e d6 6e f5 fa 14 42 d2 de a0 89 01 99 68 c7 ab 84 1b 78 ac e0 76 d5 e8 5a bd 84 39 12 4a 74 7a 7e 43 be 6f 61 61 69 61 c1 b2 8f f0 79 75 79 65 75 55 e3 01 9f ff da 3c e0 83 1f c3 03 3e 9f 88 07 7c 7b cf 3c e0 f3 9f c4 03 be fd cd 03 fe a3 79 40 b5 50 4f 69 37 70 ba 15 35 e2 50 fb e6 b6 cf c0 9c 80 96 6a 1a 73 3d 98 c7 16 4e 77 e4 ef fa 57 18 84 2c 64 65 3c 01 06 3d 07 8e 80 47 53 8f ce ed 52 0b 66 3e 42 4d 31 7e 4a 17 eb 31 34 5f 05 da d8 9e ed 4a a8 fc 46 b0 56 16 04 b6 cc 0f b4 20 3e c1 bc 06 1e 60 e6 a9 84 36 06 23 28 47 8a 1c 05 37 b7 ac 5c 22 93 da 12 34 0c bb 9f ff 77 4b 45 9b 4e c4 ce 51 6d cc 39 Data Ascii: Dn;\|%hv}o~5apMXJUzq\nBhxvZ9Jtz~CoaaiayuyeuU<>\|{<y@POi7p5Pjs=NwW,de<=GSRf>BM1~J14_JFV >`6#(G7\"4wKENQm9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49765	13.226.52.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:50 UTC	507	OUT	GET /vendor-modern.07772018.js HTTP/1.1 Host: js.intercomcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:50 UTC	793	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 150799 Connection: close Date: Fri, 26 Apr 2024 17:12:51 GMT Last-Modified: Fri, 26 Apr 2024 10:35:29 GMT ETag: "b27b573e6b04daed0b4144a6e206ba93" x-amz-server-side-encryption: AES256 Cache-Control: max-age=31536000, s-maxage=7200, public Content-Encoding: gzip x-amz-version-id: 2pQTAyPTcBEeeFQKIQ9vlX9mhAkPn2s2 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 bb707a876db211940a3cb07991cacbdc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Iw8q_0bcWQfTuVNHDaHOB8oTpxSqEf6y93uKZRrUZsikVyEV28w-fw== Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cross-Origin-Resource-Policy: cross-origin
2024-04-26 17:12:50 UTC	7525	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 7b db 38 96 28 fc fd fd 15 36 27 ed 21 23 5a 96 e4 9d 32 a3 c9 e2 54 f9 76 12 67 62 a7 aa fa 2a 2a 3d 94 08 49 2c 53 a4 42 52 5e ca d2 7f 7f cf 39 58 08 2e 72 92 ea 9e e7 ce 87 ee ea 58 c4 0e 1c 9c 15 38 00 f6 9e 6f 6f bd 8d 93 ad 30 18 b3 28 65 5b 41 34 89 93 b9 97 05 71 b4 b5 08 99 07 51 29 63 5b b7 2c f2 e3 64 77 1e fb 2c 89 9a ad e3 e3 e3 4e ab 7d d2 fc 23 6d be bb 78 7d fe e1 ea bc 99 dd 67 5b cf f7 fe 3f 73 1a c6 23 2f bc 9e 05 69 f3 8e 8d 16 de f8 e6 f5 6c 19 dd 04 51 c6 92 71 3c 1f fe 91 ba df ce b2 5a f5 07 56 73 b1 4c 67 66 bf 7f d0 ee b4 07 f6 e3 f1 c1 c1 e1 89 63 32 3b b3 23 cb 7d f1 68 2c b1 6f 59 12 8c 33 a3 7b 39 fa 83 8d b3 a6 cf 26 41 c4 3e 26 f1 82 25 d9 83 99 d9 c6 70 c8 d2 f7 b1 bf 0c 99 61 3f de Data Ascii: i{8(6'!#Z2Tvgb**=I,SBR^9X.rX8oo0(e[A4qQ)c[,dw,N}#mx}g[?s#/ilQq<ZVsLgfc2;#}h,oY3{9&A>&%pa?
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: d8 7d 2b c6 d6 71 38 1b b8 de d9 39 3c 29 cb b8 8b dd 7d 44 9f 4f ee b5 60 69 27 0e 77 58 78 4f b1 ef 0b a3 3b 2c 76 0e 44 6d a1 47 00 44 3e 5b 57 30 5f f7 02 1f 6e 11 1f 12 a3 90 51 93 75 54 00 b2 9e bb e7 48 00 3d 8e 63 e7 60 e2 9c 17 8a 80 d8 94 4d 5f ed ec dc 17 51 e6 74 bf 90 58 52 23 da 7a a7 af 4a 89 ad 02 0c 49 11 23 91 89 8b b7 9d e7 d7 8d fd e7 ef 5d f7 70 7f 5f ec 1b 2e c0 a0 b8 02 61 5b 24 64 6d d4 8d b7 8d 39 0c 07 38 78 11 34 b9 9e 82 5b 8f c0 0f 31 ef 95 e2 78 37 8a 45 88 88 ce f3 19 b4 bd 49 ed e9 ec 1f 3a 37 a0 60 ea 4d 74 3a 2d e7 95 7b 01 1a f0 41 67 5d 6c 9a ab 26 42 c5 01 34 78 45 2a cd 05 f4 73 7f bf 8c 10 90 26 f8 49 49 97 c0 d6 11 13 0d d4 b1 81 61 c8 99 03 82 bf b5 d6 ef dd 6b d0 b7 67 b6 d0 44 5a c8 f8 bf e6 7a 2a 44 81 dc 17 62 Data Ascii: }+q89<)}DO`i'wXxO;,vDmGD>[W0_nQuTH=c`M_QtXR#zJI#]p_.a[$dm98x4[1x7EI:7`Mt:-{Ag]l&B4xEs&IIakgDZzDb
2024-04-26 17:12:50 UTC	1024	IN	Data Raw: fc 57 8c 76 2f 91 ca c2 0c 99 e5 ad fa 90 40 1a 4e 93 40 81 74 d8 0e 25 c2 5e 06 35 46 72 25 19 42 c1 ff fd be c3 9a 34 18 e8 ee 39 fb 7e df f3 b4 c1 92 96 96 d6 f0 ae 77 1e 34 37 68 07 f8 d3 7f e8 0c ff d0 52 04 e4 46 49 59 e8 27 5f a2 cc 0e b3 b7 87 0c 48 a1 60 27 e1 5d 73 da 97 97 39 90 d3 77 0e b8 76 fb eb bf d1 a8 2f 34 bf ba 18 77 ba f3 b5 cc e3 2d 85 e7 fd b4 2b dd 6b 60 2e 9d 32 f2 df 1b 4c 23 d2 36 7d e9 0f 14 b4 99 23 c2 b9 41 dd 35 1a 3c 49 7b 24 12 3b f2 4c 9f c9 4c cc a0 c5 85 51 96 88 c2 36 9a f5 61 4d b1 76 32 26 34 94 97 47 19 da 5c 86 91 eb c4 34 01 a8 cd 91 c0 4d b2 78 24 47 a4 44 12 23 db 64 ac bf 33 06 f8 cd e1 44 b3 c6 11 4d 37 a6 cd 54 b7 99 56 9d b5 cc b2 25 41 19 25 3d 0c 97 25 30 dd f6 93 c0 31 1c b3 d1 f8 91 a7 66 49 1e 01 71 27 Data Ascii: Wv/@N@t%^5Fr%B49~w47hRFIY'_H`']s9wv/4w-+k`.2L#6}#A5<I{$;LLQ6aMv2&4G\4Mx$GD#d3DM7TV%A%=%01fIq'
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: 7c f8 b9 c6 73 64 53 86 34 0c e5 b5 86 32 ed ac 0f e8 a7 35 4e 20 71 86 d3 af 5e 86 00 d9 95 1b 01 79 fa 68 54 42 9c 5e 12 b9 98 37 c3 74 48 37 68 52 87 7f 8a 8a 2b ef c4 bf 33 5c 81 58 4f cd c4 e0 a1 ad dd 82 23 5c bb 83 1a 8c 92 fc df e0 0f 79 a6 39 7c e6 e0 18 78 cc 18 1e 6c 1e bb bc 65 ac 99 be 18 ce 3e d1 d6 b9 23 a9 f6 6f e6 61 1a 80 6c 67 ea ae 60 3a 99 0a b8 19 81 04 11 f1 24 90 5d 85 79 81 d7 98 80 d8 11 f4 aa 1e 52 09 fa 43 b9 9a 15 c5 2f 60 71 e3 1e bd ac f0 ab 9f e9 13 2d 32 bd c0 c1 bc 40 f7 8c 2a 0e f5 0b 72 25 d0 22 56 7b b1 3c ed e7 99 44 d9 40 22 9a 03 19 75 0d e8 55 cf b0 ab 30 fa a4 ef 63 45 50 cd a6 63 9d 4e c5 9d 04 21 3c 10 31 66 f3 49 c5 0c ce 3e fc e1 82 cb fd 5f fd 09 20 e1 f0 57 74 72 07 01 e1 86 13 b4 1a b4 df 4a 25 d2 db 5b f8 Data Ascii: \|sdS425N q^yhTB^7tH7hR+3\XO#\y9\|xle>#oalg`:$]yRC/`q-2@*r%"V{<D@"uU0cEPcN!<1fI>_ WtrJ%[
2024-04-26 17:12:50 UTC	1024	IN	Data Raw: 9c 39 ba ba 36 2d d3 bb 79 e0 d6 44 02 46 6d 2a 86 41 af fa 89 a6 ca 04 65 c4 16 c0 6e ff 40 c3 a9 7e 0f b5 4d 2a 6b b1 ae f6 da 92 0c 07 4b 00 9b 4a 59 28 a2 a9 b4 2b c0 68 a2 07 cc 9d 22 1a 60 5b 78 3d 33 f5 78 c9 03 59 93 41 f4 12 a3 9f f8 c3 21 d8 3a 89 90 f3 a9 8a 6a 80 e5 31 51 36 0b 93 04 3a 7d 9e 4d a3 77 f7 f8 6a 69 3a 1a 62 a1 ab 5d e2 cf e2 3a 06 c1 31 16 2c 8e 9d fc 21 8a 62 8a c2 dc 35 f7 7a 15 02 59 59 da df 39 56 78 a6 2b 16 23 83 92 e8 b9 04 02 44 07 57 99 0f c8 5f ab 2e 75 d9 32 9a 24 b4 2c 2a 77 ed ba f4 65 73 91 88 67 0b 28 b6 0a a6 61 58 99 b8 c6 ca cc ea ac 4c 31 af 84 f0 04 37 88 15 c5 cf a6 f0 32 ea d3 00 77 b5 50 e8 3f 94 19 0c ce de 37 da fc 25 de 4a 65 04 ab c6 e4 d4 2a d9 b2 2b 16 99 ea 6a 6c 2d 56 07 41 d5 c4 9d 14 ad a1 aa 60 Data Ascii: 96-yDFmAen@~MkKJY(+h"`[x=3xYA!:j1Q6:}Mwji:b]:1,!b5zYY9Vx+#DW_.u2$,wesg(aXL172wP?7%Je+jl-VA`
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: 56 60 cf aa 37 67 c6 5b fb bb 45 b7 63 07 46 49 5c 9b a3 e3 d7 6d 10 0f bb fe 9a da c7 b0 b2 b9 ad e0 3c 3c 8f d3 33 59 d0 13 90 a9 bb a6 ba 3d 60 ba 07 7b 44 e4 b5 03 9f 1a 8b 47 c7 18 8e b2 3e 01 c1 ba e3 f0 7a 96 f9 ab 1b df 66 ca 76 0d 94 2d 11 da 8e 68 2a 01 39 00 a6 b0 12 40 67 a5 a9 83 ac 1e 56 37 08 ab f3 55 06 91 91 b3 3b 62 7f 37 23 68 9d 3e 30 3f 9a a0 27 51 95 40 48 96 a4 c2 6b 5d db 93 f4 1e 4b 55 33 a9 ce 2e 48 c9 ef 25 c9 b7 87 f0 fd f8 8c 98 db dd 52 5e f8 b9 24 4d 4b aa 07 e1 14 a9 48 83 3a 2b 53 2f 50 8a 9a b6 20 00 96 bb 5a 0f 36 0f 28 82 09 99 1b a1 dd 62 72 74 b3 c2 d8 74 13 06 3e 47 03 e9 47 ad 55 47 d9 ad 61 f2 2f 95 c7 95 31 f8 9a ac c6 03 c9 23 2a 83 14 33 fd 92 94 7d 4c e9 6b 1b 33 2d cc 4c 45 2d 18 04 99 25 33 1c a6 82 6f e0 70 Data Ascii: V`7g[EcFI\m<<3Y=`{DG>zfv-h9@gV7U;b7#h>0?'Q@Hk]KU3.H%R^$MKH:+S/P Z6(brtt>GGUGa/1#3}Lk3-LE-%3op
2024-04-26 17:12:50 UTC	1024	IN	Data Raw: 41 97 ab 52 81 00 3a b2 1d ae 99 bf 09 66 aa 86 7f c0 69 95 f6 d9 d9 4b c4 57 b6 08 8c 1a 89 68 c4 4a c2 ae c6 e1 77 8a eb cc 27 30 bc e9 09 ce 8b e3 48 1a bb 01 36 96 e2 12 59 3f e4 fb a1 41 50 8b 69 ad e7 26 ee fb e0 75 65 78 a5 3b 83 a3 b9 33 2c df 11 f9 51 c4 02 88 58 85 04 28 c2 bb 51 2f 2c 97 ed 78 10 22 da 12 7d 07 0c 7a 7d 17 d7 c6 12 7d 48 10 a3 54 f9 b0 2f f2 57 f7 d5 2c 70 74 1b c3 d2 b1 f4 05 80 af b0 2f a9 11 87 fc 41 09 11 ce e4 24 16 36 16 6d ec 74 5e c6 6b fe b7 1f 32 cf 3a 50 32 cc fd da 30 65 97 04 a0 8e d5 e7 38 7c c4 79 68 f2 3b c3 bb 31 7f 1f e4 02 e2 0e 3e 8c 3d 11 cd 84 24 e6 f3 62 b4 45 cf f3 9d 82 e7 ab ca ec be 86 ef 50 92 00 8e 5b e2 37 4c a2 38 b7 cd fe 3f 47 fc ae 14 c4 83 b7 06 7d 60 aa f6 0c 21 74 a1 4f a7 85 80 c4 dd 2e de Data Ascii: AR:fiKWhJw'0H6Y?APi&uex;3,QX(Q/,x"}z}}HT/W,pt/A$6mt^k2:P20e8\|yh;1>=$bEP[7L8?G}`!tO.
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: 58 e9 6f ba 5a 97 06 bf 5b 44 e1 e1 14 a7 47 e1 ad a0 f0 f3 31 60 c4 26 c2 47 12 ba b3 d2 f5 3a 4d d7 9c d7 ab 54 52 0b 48 10 73 3d b7 83 df 1f b1 53 17 cc 7c b0 ac 21 2f 26 81 a0 95 31 84 37 a6 eb d9 e0 9a 16 be eb 8b 9d c3 ad 7d 2c bd 43 db a6 9b ac 1c 7c dc 30 7d f4 55 16 fe ef aa 25 22 fc 23 57 5b 2d 87 9f 2e 47 22 97 83 58 48 78 49 a7 bd 3d 62 23 58 d7 97 b1 32 68 be 7b c4 d5 89 f9 4e 78 be b3 7d 9e a7 7d 9e 9a 1f f4 9a e3 8a 55 4e 39 5c 8b e2 57 39 f9 18 22 d7 5e 11 bd 38 56 34 f2 2b 7c a6 45 33 bc 72 e4 69 71 ae f1 a9 57 60 d6 90 14 83 31 8d 97 0b 1f 72 ce 49 20 77 d4 db d3 1b a7 84 24 18 50 7c 1c fb 93 ee 65 16 11 11 f1 61 18 13 a4 9b 8b da b0 ad 05 6e 62 9f bf 82 b7 5a e6 f8 88 07 e1 1e 29 72 ff b8 6f ac c0 b9 2a d7 60 f6 e0 61 7e e6 f4 53 13 d6 Data Ascii: XoZ[DG1`&G:MTRHs=S\|!/&17},C\|0}U%"#W[-.G"XHxI=b#X2h{Nx}}UN9\W9"^8V4+\|E3riqW`1rI w$P\|eanbZ)ro*`a~S
2024-04-26 17:12:50 UTC	1024	IN	Data Raw: 46 58 e4 d2 7d 2f c9 3b d0 b6 69 55 14 a7 01 be cd 36 bb 04 4b 94 43 dc 5d 58 c5 a8 9d 60 72 0d c6 aa d0 8e 11 13 88 aa 5e 58 90 c2 36 b0 52 bf c4 22 72 d3 35 3a 60 39 fe e1 96 23 9d 55 38 d2 04 65 03 27 a5 a9 3a 91 a6 13 e8 48 8d 5f 71 e4 cc 6e b1 f7 5d 91 5f 24 f2 0c ae f9 ea d1 46 6e 6d 24 01 53 91 35 fc f0 7c 11 a2 16 af 40 44 8c a2 57 80 ce e4 c8 38 83 2f 2a 90 34 95 85 d8 c9 da ef 1f 8d cb 54 38 aa d0 af dd b7 95 00 4a 4a a0 ea 19 09 94 4d d7 74 61 f5 5d 7e 82 ba 38 62 59 95 2c 2e 3f b0 11 36 1b 52 ad 23 eb e8 c8 ee d3 05 dc 1d ad 42 82 4e 7e 42 b3 cd 21 f9 e0 35 f8 80 48 2c f6 1c d4 01 6b 4b 25 a8 a8 d3 a8 3c d9 00 7c 22 f3 8d 68 19 f7 23 dd 2e 40 e4 ee 12 f1 98 44 73 73 d8 27 f8 a5 66 1d cd 58 b9 fc 7e 8e fe c5 d1 8f 38 6c aa 19 19 4d 7c 9f 9f 0b Data Ascii: FX}/;iU6KC]X`r^X6R"r5:`9#U8e':H_qn]_$Fnm$S5\|@DW8/*4T8JJMta]~8bY,.?6R#BN~B!5H,kK%<\|"h#.@Dss'fX~8lM\|
2024-04-26 17:12:50 UTC	16384	IN	Data Raw: 24 19 44 c7 45 2f e4 70 0f 52 d9 d5 a9 de 10 a1 8d 08 4b 50 35 d9 17 b3 ae a8 de 2e 54 b1 23 5f ef 2d 6c d6 9b 22 83 42 b5 50 93 71 cb 3e 5a 3c 0e c4 5b 7d 8f a8 1c e9 1e 64 43 81 4e bd d0 6a cb c8 7c 50 ab d6 ea ca da ff b0 71 c0 76 b0 4a 36 45 fb 4e 14 ff 1f ee de 85 2b 6a a5 5b 14 fd 2b d0 d7 c3 48 36 05 ab 1b 14 35 6d 56 1f 45 58 ba 7c 2e 51 97 ca c7 e5 84 ee 02 a2 dd 49 9b a4 41 84 fe ef 77 3e ea 99 a4 01 d7 b7 f7 39 fb 5c c7 90 ae 54 2a f5 9c 55 35 df 33 cd 6e 52 77 41 a7 39 78 2e a0 3f 59 20 91 d1 9e 02 4e 48 f8 73 81 26 2c 88 50 b6 30 38 c2 ea b4 c8 cf 49 3d 02 39 8e 64 73 15 74 e0 0c 01 a0 96 a3 a5 c4 0c 0b 36 9c 4e 2e 61 50 55 45 81 95 70 e7 8e 35 ae 55 c6 63 1d cd f2 34 ae c8 21 24 d3 cf 05 3a a0 33 9f 1f 39 42 c5 b5 69 c3 a1 fe f4 ea 0a 48 74 Data Ascii: $DE/pRKP5.T#_-l"BPq>Z<[}dCNj\|PqvJ6EN+j[+H65mVEX\|.QIAw>9\T*U53nRwA9x.?Y NHs&,P08I=9dst6N.aPUEp5Uc4!$:39BiHt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49769	54.165.219.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:51 UTC	597	OUT	POST /messenger/web/ping HTTP/1.1 Host: api-iam.intercom.io Connection: keep-alive Content-Length: 512 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:51 UTC	512	OUT	Data Raw: 61 70 70 5f 69 64 3d 62 74 64 6e 36 36 76 34 26 76 3d 33 26 67 3d 35 61 35 31 39 32 36 66 30 37 35 35 62 37 63 62 63 39 34 33 30 63 64 36 62 38 34 61 33 33 62 32 31 66 65 61 35 64 37 66 26 73 3d 30 39 33 65 64 65 36 37 2d 36 64 62 36 2d 34 38 36 65 2d 61 63 36 62 2d 36 63 30 31 65 39 34 64 64 39 34 62 26 72 3d 26 70 6c 61 74 66 6f 72 6d 3d 77 65 62 26 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 5f 74 79 70 65 3d 6a 73 2d 73 6e 69 70 70 65 74 26 49 64 65 6d 70 6f 74 65 6e 63 79 2d 4b 65 79 3d 63 38 66 66 33 61 66 64 61 30 38 34 39 33 36 36 26 69 6e 74 65 72 6e 61 6c 3d 25 37 42 25 37 44 26 69 73 5f 69 6e 74 65 72 73 65 63 74 69 6f 6e 5f 62 6f 6f 74 65 64 3d 66 61 6c 73 65 26 70 61 67 65 5f 74 69 74 6c 65 3d 49 6e 76 6f 69 63 65 25 32 30 35 36 35 37 36 25 32 30 2d Data Ascii: app_id=btdn66v4&v=3&g=5a51926f0755b7cbc9430cd6b84a33b21fea5d7f&s=093ede67-6db6-486e-ac6b-6c01e94dd94b&r=&platform=web&installation_type=js-snippet&Idempotency-Key=c8ff3afda0849366&internal=%7B%7D&is_intersection_booted=false&page_title=Invoice%2056576%20-
2024-04-26 17:12:52 UTC	962	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:12:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Status: 200 OK Cache-Control: max-age=0, private, must-revalidate Access-Control-Allow-Origin: https://in.xero.com Vary: Accept,Accept-Encoding Strict-Transport-Security: max-age=31556952; includeSubDomains; preload Access-Control-Expose-Headers: x-request-id X-Intercom-Version: e64aea2276c5131ea3a8490f307bc11a91aecc29 X-XSS-Protection: 1; mode=block X-Request-Queueing: 0 X-Request-Id: 0008llbakphc8hl0tgrg Access-Control-Allow-Headers: Content-Type, Idempotency-Key, X-INTERCOM-APP, X-INTERCOM-PAGE-TITLE, X-INTERCOM-USER-DATA Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS ETag: W/"6e0d65205602ea8f6c3514fe70ef1efc" X-Runtime: 0.366154 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Server: nginx x-ami-version: ami-07f0efd8322b9d369
2024-04-26 17:12:52 UTC	5829	IN	Data Raw: 31 36 62 64 0d 0a 7b 22 61 70 70 22 3a 7b 22 6e 61 6d 65 22 3a 22 58 65 72 6f 22 2c 22 61 75 64 69 6f 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 68 6f 77 5f 70 6f 77 65 72 65 64 5f 62 79 22 3a 66 61 6c 73 65 2c 22 74 65 61 6d 5f 69 6e 74 72 6f 22 3a 6e 75 6c 6c 2c 22 74 65 61 6d 5f 67 72 65 65 74 69 6e 67 22 3a 22 48 69 20 74 68 65 72 65 20 f0 9f 91 8b 22 2c 22 6d 65 73 73 65 6e 67 65 72 5f 62 61 63 6b 67 72 6f 75 6e 64 22 3a 6e 75 6c 6c 2c 22 65 78 70 65 63 74 65 64 5f 72 65 73 70 6f 6e 73 65 5f 64 65 6c 61 79 5f 74 72 61 6e 73 6c 61 74 69 6f 6e 5f 6b 65 79 22 3a 22 63 6f 6e 76 65 72 73 61 74 69 6f 6e 5f 63 61 72 64 5f 75 6e 6b 6e 6f 77 6e 5f 72 65 73 70 6f 6e 73 65 5f 74 69 6d 65 22 2c 22 6c 61 75 6e 63 68 65 72 5f 65 78 70 65 63 74 65 64 5f 72 Data Ascii: 16bd{"app":{"name":"Xero","audio_enabled":true,"show_powered_by":false,"team_intro":null,"team_greeting":"Hi there ","messenger_background":null,"expected_response_delay_translation_key":"conversation_card_unknown_response_time","launcher_expected_r
2024-04-26 17:12:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49770	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:53 UTC	777	OUT	POST /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=18937&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 68 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:12:53 UTC	68	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 34 37 72 2c 31 3b 36 2c 27 63 6c 73 2c 30 2e 3b 65 2c 27 6c 6f 61 64 2c 35 72 77 2c 31 3b 36 2c 31 2c 30 2e 3b 65 2c 27 66 63 70 2c 36 6a 64 2c 31 3b 36 2c 31 2c 30 2e Data Ascii: bel.6;e,'fp,47r,1;6,'cls,0.;e,'load,5rw,1;6,1,0.;e,'fcp,6jd,1;6,1,0.
2024-04-26 17:12:54 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:12:54 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760058-MIA
2024-04-26 17:12:54 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49771	13.226.52.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:53 UTC	521	OUT	GET /vendors~app~tooltips-modern.7e0e68e9.js HTTP/1.1 Host: js.intercomcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:54 UTC	793	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 166299 Connection: close Date: Fri, 26 Apr 2024 17:12:55 GMT Last-Modified: Fri, 26 Apr 2024 10:35:29 GMT ETag: "d625db79db383fdaef04243566c4afce" x-amz-server-side-encryption: AES256 Cache-Control: max-age=31536000, s-maxage=7200, public Content-Encoding: gzip x-amz-version-id: ztY3G0j7JCvbRLweLkZeJYlzrk1xS0.n Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 130ce7c752c5865952ded89032560b32.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: LFGlBsUxn7agivEY7lqPIfoQyi40dVCLZKRMqtLFHKzMN5jbOea6MA== Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cross-Origin-Resource-Policy: cross-origin
2024-04-26 17:12:54 UTC	6396	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd e9 73 1b 47 96 2f fa fd fd 15 14 a6 2f 1b 18 82 14 a9 cd 36 28 48 97 12 29 4b 36 b5 b4 44 d9 6e 8b 1a 4e 11 28 92 65 02 28 b8 50 20 45 8b 9c 0b ee fb be af e2 be ef fb ce 08 53 96 65 5b 5e ba dd 76 bb dd 5e 2a dd 0c c4 7c 78 11 f7 fd 09 ef 9c cc aa 42 81 84 3c 3d 1d fd 3e bc 88 6b 8b 55 99 59 b9 9c cc 3c cb ef 64 66 15 4e ff eb a9 a8 6b a2 14 e5 12 1c bc c7 c7 47 09 9e 2c 51 72 73 b2 20 7a a2 bc 2e 9e 83 24 1f cf 47 e5 f1 1e a7 28 f9 fe 83 f3 7a ff 43 16 45 97 2c 78 7d b1 6e d1 c9 4b 9e b8 57 f8 78 fe c2 ab fc 6b 71 ef f9 e2 52 6f 5c 4d b9 75 2f 25 4e 7e 24 47 fd eb e9 ff cb 9c ed 12 33 39 57 5a 8e e0 8b cb e7 33 bd 9c 23 f7 6a 8e df 93 2b 78 64 5e 72 88 ee 8c f7 7c f6 ff 3a 4b 61 e1 83 87 96 38 af df 97 63 7e f0 e0 fc Data Ascii: sG//6(H)K6DnN(e(P ESe[^v^*\|xB<=>kUY<dfNkG,Qrs z.$G(zCE,x}nKWxkqRo\Mu/%N~$G39WZ3#j+xd^r\|:Ka8c~
2024-04-26 17:12:54 UTC	1130	IN	Data Raw: 3b da 66 2f 60 03 93 ca 62 77 c2 ba 7d 3f d4 6d b5 97 5a 11 b6 a5 af 6f 6f 6b 5b ac 6c 6b 59 ad eb 7a 58 5d ef 87 ea a2 ee ab b6 2c c7 96 b2 05 e3 72 b3 f6 36 c7 4b 16 72 d5 35 56 c3 22 a7 d6 1f 75 d1 52 1b 00 1d ff bd cd db e9 1b 24 b6 d3 78 b0 3b 2e ff 6c 9c 28 65 9f 4e 78 ed b5 57 4f df 84 49 a0 97 9b a9 26 eb b5 88 f9 10 c8 9c a6 83 f9 d6 cb ea 79 ed f4 23 7a de 81 f6 fb 03 de fe 16 6f 7d 9d 32 d3 ef c3 c6 e0 37 da 18 bc cd 43 5b 50 dd 43 6b 16 1b ab 77 c2 f2 bd c9 db 61 98 bc 80 9b 1d 94 d5 58 ed 31 8c e1 70 ba 4f d3 d6 1e d2 a2 ef aa 12 f1 bb b0 2a de 88 60 65 a8 e3 6a b1 f2 42 c4 83 7c 51 02 5d 1d 70 b0 c3 81 78 dc ac b0 30 2c f1 9a 5a a8 c8 2a 08 c6 53 90 48 c4 3f fc ca 06 18 0a 7c 57 e3 77 7c 61 e1 ef f0 b0 14 7b 99 18 4d 83 2a 37 21 73 51 58 68 Data Ascii: ;f/`bw}?mZook[lkYzX],r6Kr5V"uR$x;.l(eNxWOI&y#zo}27C[PCkwaX1pO`ejB\|Q]px0,ZSH?\|Ww\|a{M*7!sQXh
2024-04-26 17:12:54 UTC	16384	IN	Data Raw: e2 81 ba 44 b7 d7 2f 09 59 05 a6 18 b3 7c d9 f4 2f a6 18 d9 06 dd 4b 94 a5 82 d0 bb 29 46 ea cc 1e eb e3 d0 50 e0 57 84 b4 55 11 7d 40 69 62 91 a5 c8 41 3f 02 f3 b2 33 ec 69 86 f5 a6 28 d6 95 28 53 8c 27 c6 04 f9 fc 2e 67 14 78 90 51 99 7c 14 ab db 19 67 d2 8e b7 9b af 59 39 0b 8b 9c a2 03 7f e2 f5 82 df 41 af 4f ce 98 25 51 8a 8e 96 10 12 83 0f c0 17 15 59 65 41 f3 b5 98 73 29 ea 1e 66 c8 b9 04 29 13 f5 6c c7 5d 55 d5 83 d5 1c ab 63 4e 2f 14 f5 e8 45 b5 3c c6 cd 7c 13 3b 2d ac 7a a4 90 5d 52 b3 27 59 12 af 98 25 81 69 54 b8 df d6 e6 cb a7 66 b8 87 19 7c 82 f5 aa f6 c0 1f ee ac 78 cd fa 0a a7 f5 b1 7a ca dd 06 33 42 67 95 8f 0b 2d c3 a9 b9 ae e2 5a 1d be 7f c0 66 4c c0 17 b9 42 ef 53 5a 39 e1 18 67 63 35 61 6d e8 76 d6 16 ce 6b d8 06 8e 38 7e 9c c8 26 18 Data Ascii: D/Y\|/K)FPWU}@ibA?3i((S'.gxQ\|gY9AO%QYeAs)f)l]UcN/E<\|;-z]R'Y%iTf\|xz3Bg-ZfLBSZ9gc5amvk8~&
2024-04-26 17:12:54 UTC	1024	IN	Data Raw: d0 2a 7a e6 2c 05 b1 07 c2 7b a4 b7 9a f4 82 3e 5f 3d 65 2a 88 bd a5 a4 17 96 49 b5 a9 20 f6 96 31 9d b0 b7 81 f4 36 9e 46 2b 6d a0 67 87 29 88 13 c0 36 f3 80 59 85 8a be 20 bd d3 a4 77 95 f4 6e 90 be 1e d2 b7 40 fa 8b 49 7f 25 e9 6f 42 ff 4a d2 3b 4f 7a 97 d0 37 74 16 d5 10 50 ac 66 8e 46 8b 81 1f a0 66 d5 7b 40 fa ea 49 5f 9b 75 7d e5 68 72 82 f4 55 9a f7 56 8e 26 97 61 8f 1e 82 5d e1 e0 ae 1d b3 17 74 ac 89 a4 6f 9c f4 4d a3 d5 86 b4 ce 59 66 6f d8 3d 7a f2 15 d2 b7 4e fa b6 48 df 1e ea 96 e5 16 c7 ed 67 27 84 73 d6 39 e3 2a cc 45 7f 2d e9 6f 44 bd b3 aa f3 70 f8 b8 be 01 95 da 7c d2 df 49 fa bb 8e 87 22 a7 9d 35 aa 1f f1 d5 df 85 e6 35 50 db fb c7 48 ff f8 49 64 0a 4a 4c 20 f5 78 0b 02 21 d2 bf 42 fa d7 49 ff 2e 19 28 27 03 95 c8 5e 47 a6 ac e9 59 af Data Ascii: z,{>_=eI 16F+mg)6Y wn@I%oBJ;Oz7tPfFf{@I_u}hrUV&a]toMYfo=zNHg's9*E-oDp\|I"55PHIdJL x!BI.('^GY
2024-04-26 17:12:54 UTC	16384	IN	Data Raw: e7 15 a6 af 4c b6 1e cd 6e 7e bd 42 26 07 41 df 9a 1c 0d 22 39 0c 1d cd 6e 98 ae 30 47 0b 5b 30 23 68 f4 d7 40 d5 98 5c 25 93 fb 64 aa 94 4c 35 91 a9 56 d8 42 4f 6e 61 21 d0 48 a6 4b 99 a7 57 95 e9 bd 5a 81 af 39 00 8f 5a 83 cc 78 4a c4 ba 35 f7 cd 26 9e 1a e1 fb 33 7b 26 41 b7 fe 36 72 33 dd e3 7b 6e bc 38 9a 6f 21 53 30 97 73 64 6a 87 4c 17 93 e9 72 32 dd c4 f6 97 9d d0 e7 02 9d 4c ad 90 a9 75 10 64 63 63 cc 25 b4 71 f9 b8 71 d1 aa b8 ba e9 9b cd b0 7c b8 7e 34 37 8a 7e b2 64 ba 86 4c 37 30 3f c9 29 90 a5 f3 5d 32 13 58 c6 d1 fc d0 d1 bc 73 3d 63 06 c4 15 30 a0 a3 05 68 68 82 4c 6f 91 e9 5d a6 23 1c cd ef 42 4f 8f 16 86 6d 88 e5 58 35 35 86 85 11 94 ce 0b 51 c6 1b e7 d7 49 b4 18 d4 95 f9 8d 5f c3 ee 3f 48 a2 35 24 5a 4f a2 cd 28 4c c7 97 d8 11 20 73 7e Data Ascii: Ln~B&A"9n0G[0#h@\%dL5VBOna!HKWZ9ZxJ5&3{&A6r3{n8o!S0sdjLr2Ludcc%qq\|~47~dL70?)]2Xs=c0hhLo]#BOmX55QI_?H5$ZO(L s~
2024-04-26 17:12:54 UTC	1024	IN	Data Raw: e9 0c 57 0f 73 6f e1 f2 0a e7 b1 a5 05 7d 60 3d 78 94 7e 0f f2 1a 9e 40 30 de c2 7a 94 71 db 44 a9 21 79 6d 7c 7e 8b e8 01 a2 ff 98 55 a1 cb cf 24 2b 26 fb fe 5d 16 a3 a9 7e 53 3c dd 42 d1 94 77 9e a8 7a 84 e8 34 4c 5c 7e 07 b1 f5 61 76 36 f2 80 7c 4d 0b c5 08 2c 9c 34 04 60 ce 18 9c 89 6c 09 df a9 8f 11 67 20 cd 38 b1 c6 18 c7 43 64 1b 2c f5 e7 b8 38 8a 60 75 bc 4a 34 5e ab e1 c4 93 7c bc 02 14 8f 1d 88 cb fe 8c 48 74 c5 5d fa 2f 32 91 1f bc 90 d9 ec d9 1c da 65 ce b7 33 b2 b2 1e 00 df c8 44 94 7b 25 45 09 02 ef 90 4d bc 63 1a cc d6 6d 27 cd c0 57 dc ad 34 71 25 c7 08 50 58 bf e6 34 c3 f2 b5 67 1a 44 4b 86 89 49 54 26 6d 6c de c9 7c 88 2b f6 3b 0a 8a ac 74 ec 12 7e 19 26 8e d8 c8 bd 75 87 f9 75 05 c3 79 3e 8f d9 bf 87 19 9f 64 3c 7c 84 02 4c 97 0a f1 13 Data Ascii: Wso}`=x~@0zqD!ym\|~U$+&]~S<Bwz4L\~av6\|M,4`lg 8Cd,8`uJ4^\|Ht]/2e3D{%EMcm'W4q%PX4gDKIT&ml\|+;t~&uuy>d<\|L
2024-04-26 17:12:54 UTC	16384	IN	Data Raw: e4 71 fa 3b bf f4 bc f3 05 74 ef 09 f0 16 60 2d 10 99 c4 37 63 00 be 6e 78 cd 67 9a cc de 9b bd 7a 62 7c f0 c4 07 05 e0 ef 9f d9 e3 4a 4c cc 87 8c ef e4 7b 02 b2 f2 12 24 80 a2 e9 5f 71 55 99 11 e6 38 bf 62 b5 7c 65 aa 6b 56 8a 05 b0 29 b1 01 dd e3 93 c3 c6 57 96 ee f6 4e 48 0b 3a e1 3c 2d 14 d2 02 0e 88 9f a7 75 00 26 4e be 62 bd c1 01 7c c5 f0 6c b5 ec b6 a9 78 82 86 d3 12 56 6d 05 59 df 92 60 88 7f f6 18 70 03 18 02 f4 fc d7 77 9e 18 4f fe 9f 94 e4 a7 7f 76 f3 f1 13 e3 e9 9f 25 7d 79 29 39 f5 da ab 3f 41 9e 9b 68 c4 5f 51 8c eb 9c f1 ce 65 8b c9 a2 dd 58 07 9d b7 52 6f 3a e7 7b 71 af cf ba ae bd ce d3 a5 d2 07 a1 34 e6 34 2b a7 04 3c 21 6f 01 73 e4 4a 84 ba 2e e1 dd da e4 10 68 43 36 d7 51 92 92 b5 a4 b3 9c 2b 53 65 7c da f2 fa fd 53 87 49 69 c9 09 7f Data Ascii: q;t`-7cnxgzb\|JL{$_qU8b\|ekV)WNH:<-u&Nb\|lxVmY`pwOv%}y)9?Ah_QeXRo:{q44+<!osJ.hC6Q+Se\|SIi
2024-04-26 17:12:54 UTC	1024	IN	Data Raw: d8 2d d2 ae 0c e2 fc 56 5a 41 ef f1 dc c0 73 97 e0 ab f8 78 f6 87 99 db 49 3f cc e3 a0 56 89 1f 02 31 33 5b 2f 81 54 69 0c 36 fa b0 9c 7f f8 ff 51 b4 3b ff c3 18 43 9e 61 9b f3 a3 c2 7f d4 fe a3 15 e8 c6 05 af 6d 77 f6 c9 8c dc 95 9a 1f 7d 29 6f 5d a5 68 05 72 1a 20 d5 3f d6 ff b1 fd a3 ff c7 92 1f ab 7f 6c ff b1 fb c7 be 1f 47 7f 2a fc 69 f5 e7 8a 9f 6b 7e 6e a2 cd 6c 02 61 0d 8a 64 d3 93 cf 91 aa 6a cf 5f 85 e2 d9 8f 0d 3f b6 32 54 aa de f3 23 e3 68 a5 73 30 8b 5d a8 e3 68 54 b9 e7 af 04 72 64 76 fe d8 fb e3 cc 8f 3b d0 de ac 1f 17 7f 5c 41 3c 1a 17 ed 66 57 ce 45 00 d0 52 ab 28 ec 2e 7c d1 f5 f1 e2 4f 65 b7 93 7e ea 47 36 fc 53 d5 4f d5 c1 d2 49 c0 1f d7 4f 0d 3f b5 32 9e 39 21 3f b1 03 93 54 80 d6 4e ad 40 55 ce a6 fe 34 f9 d3 bc 03 a0 06 a4 ba 01 26 Data Ascii: -VZAsxI?V13[/Ti6Q;Camw})o]hr ?lG*ik~nladj_?2T#hs0]hTrdv;\A<fWER(.\|Oe~G6SOIO?29!?TN@U4&
2024-04-26 17:12:54 UTC	16384	IN	Data Raw: d3 02 1f b0 5a d0 78 ae 51 75 a7 b4 41 41 f3 42 60 a7 d2 18 d0 80 ea ce bf f9 de a2 1a 28 90 70 69 7c 40 1a 1f 91 c6 a7 a4 09 9f 34 d9 28 4d b6 49 cb 75 d2 72 8b b4 cc 88 59 39 93 ba 8b fc 0c 4d c7 17 a5 f1 35 69 7c 9b a2 69 51 09 45 d3 a2 22 48 d7 05 f4 d2 fd 40 9a 28 91 26 66 a5 c9 6a 33 1a 2a 7f ea bb 0c a0 37 d1 20 4d f4 48 13 a3 42 46 a8 d1 be 8a 6c 11 28 b9 5d 9a 18 96 26 5a 77 27 a4 89 36 90 13 52 b3 c5 dd 69 70 7a 84 8c 27 be 37 2f 49 13 ab d2 64 31 03 15 06 47 bb f3 df 2f 00 c0 5c 12 dc bb 0b d2 58 29 e5 61 7b be 72 de ed ba 67 be 33 76 a7 47 9a ec 97 26 47 a5 c9 15 69 72 9d 1e 4e 09 e6 f7 9e 41 07 e0 34 ab 7f af a0 17 c7 ab e9 07 50 97 ce a5 bc 79 e1 d2 95 6b d7 6f 40 53 a7 9a a4 a9 66 69 6a 5c 9a da 94 a6 fb a4 99 09 69 b6 50 9a eb 96 e6 0b a5 Data Ascii: ZxQuAAB`(pi\|@4(MIurY9M5i\|iQE"H@(&fj3*7 MHBFl(]&Zw'6Ripz'7/Id1G/\X)a{rg3vG&GirNA4Pyko@Sfij\iP
2024-04-26 17:12:54 UTC	1024	IN	Data Raw: 2c a9 c9 2c b1 8d 6c b9 60 b6 5c 30 5b 2a 98 2d 16 cc 2a f8 d8 63 5e f2 20 72 e5 3a 73 e5 3a 73 a5 3a 73 e3 8a 8a 4d f0 93 09 37 89 7f 38 cd 01 ef cb 8d dc 97 1b b9 2f 35 72 5f ac f5 73 39 67 c1 c7 b9 79 77 3d f2 f8 5a 44 b2 22 b7 a1 c8 25 15 a9 0d 45 1e 88 22 4d 24 7e ba d1 83 54 b1 0d bf 3c 91 aa dc a4 2a 37 a9 4a 4d aa 62 1b 9a 5c 50 93 0b 6a 52 41 4d 2c 88 cf 37 b8 8b 5a 1e 84 21 d7 69 c8 75 1a 52 9d 46 5c 51 b1 89 80 56 e2 25 c8 d3 18 93 9b 88 c9 4d c4 a4 26 62 62 9d 4f e5 9c d1 62 c3 14 18 9f 98 33 43 e2 40 8a 04 65 14 b2 4b ad 6e a2 0c 66 18 41 41 92 29 12 74 47 6e df 2f 83 77 a4 8e fb 25 e8 8e c4 9d 44 e0 8e 5f 31 85 26 fc 32 98 29 83 81 b8 54 d0 73 0c 4f 74 05 64 30 4b 1a b5 ea 42 a8 69 64 89 5d 50 45 20 4b 1a b1 2a 41 59 72 f3 aa 0c 7e 24 8d 38 Data Ascii: ,,l`\0[-c^ r:s:s:sM78/5r_s9gyw=ZD"%E"M$~T<7JMb\PjRAM,7Z!iuRF\QV%M&bbOb3C@eKnfAA)tGn/w%D_1&2)TsOtd0KBid]PE KAYr~$8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49772	13.226.52.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:53 UTC	517	OUT	GET /vendors~tooltips-modern.8e0f853f.js HTTP/1.1 Host: js.intercomcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:54 UTC	792	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 11457 Connection: close Date: Fri, 26 Apr 2024 17:12:55 GMT Last-Modified: Fri, 26 Apr 2024 10:35:32 GMT ETag: "549d63dc73c5770ca6c7acd1abdeaaa1" x-amz-server-side-encryption: AES256 Cache-Control: max-age=31536000, s-maxage=7200, public Content-Encoding: gzip x-amz-version-id: vks3WbEcfRpcdBtgC65QsBT2uMdzltRr Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 d1c64d10e2bd86b43a04bfb63e7766c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: AOpSnZYEmtYY8wE8eYrkMpVbklsGiPCN02Sz-wcntD6amuq7Mauqpw== Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cross-Origin-Resource-Policy: cross-origin
2024-04-26 17:12:54 UTC	11457	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 6d 73 db 36 b3 e8 5f b1 79 3a 1a b2 86 14 39 49 d3 84 2a aa 71 6c a5 49 4f 1c fb 71 9c 26 ad ae 4e 4a 53 90 c5 98 22 55 92 92 a5 5a fc ef 77 77 01 82 20 45 39 49 6f e6 39 f7 c3 33 e3 11 49 bc 63 b1 ef 58 c0 f6 75 18 5f 79 e1 e5 34 48 3b b7 e2 6a ee f9 37 c7 d3 45 74 13 44 99 48 fc 78 f6 f1 53 ca 3f 5f 64 b3 19 8e 9c ce 7c 91 4e ed e1 f0 c7 47 8f 9f 8c d8 dd 93 47 4f 1e 3e 76 6d c1 32 87 ff 7c 67 2d 52 b1 97 66 49 e0 67 56 6f e9 25 7b 11 4b 58 cc 02 e6 f5 b2 ce f9 84 67 9d 2c 85 9f 93 31 fc 7c 38 84 9f 55 02 3f 7f 2d e1 e7 3a 84 9f 77 3f c0 cf 8b 2e fc bc fa 15 7e ce 9f c2 cf 1f 1f e0 e7 f7 05 5f c6 c1 78 af cb 26 8b c8 cf 82 38 b2 85 73 27 86 a2 33 08 c5 4c 44 d9 f3 78 11 8d 53 de 1d 71 ab 92 62 31 2c 74 29 56 45 89 43 Data Ascii: }ms6_y:9I*qlIOq&NJS"UZww E9Io93IcXu_y4H;j7EtDHxS?_d\|NGGO>vm2\|g-RfIgVo%{KXg,1\|8U?-:w?.~_x&8s'3LDxSqb1,t)VEC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49774	13.226.52.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:53 UTC	513	OUT	GET /app~tooltips-modern.99a3541c.js HTTP/1.1 Host: js.intercomcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:54 UTC	792	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 53858 Connection: close Date: Fri, 26 Apr 2024 17:12:55 GMT Last-Modified: Fri, 26 Apr 2024 10:35:28 GMT ETag: "baecefd335b4e7fce271d6e3489a58a4" x-amz-server-side-encryption: AES256 Cache-Control: max-age=31536000, s-maxage=7200, public Content-Encoding: gzip x-amz-version-id: ADIgaUsJE6KcnFAo53qxUIMew4_L13ES Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 177fd0f8c3e2c78883d72714aa07183a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 3zBzK2UbjHcTNqG_uKWtYJxbfHmcRMbuMLrJkml198vB24VL78Dhxg== Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cross-Origin-Resource-Policy: cross-origin
2024-04-26 17:12:54 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 8b 62 db 46 92 28 fa 2b 14 36 d1 10 e3 26 cc 37 29 2a 8c 56 96 ed c4 33 7e 6d e4 bc c6 eb a3 80 44 53 84 05 02 34 00 4a 62 28 ce b7 dc 6f b9 5f 76 ab aa bb 81 c6 8b a4 93 cc ec ce b9 b3 9b b1 40 a0 df 5d 5d 5d ef 32 56 11 af 45 71 e8 4e 63 e3 b4 7e ed 05 13 db 7b 37 77 23 eb 8e 4f 96 f6 f4 e6 62 be f2 6f 5c 3f e6 e1 34 58 5c 7d 8c c6 fb 8b 3c 3c bc ff 60 5a cb 55 34 af bf 7f 3f ec f6 db 1f d8 66 d8 1f 76 87 a3 3a 67 31 0b cc f1 d7 9b c0 72 ea 31 db 9c 8f ea f0 eb c9 2a 8e 03 ff 9b 30 58 2d cf 63 18 ca 64 15 f3 ad 79 7a 6b 87 b5 70 1c d4 4f fa bd 6e d3 64 2e 3c 76 e1 b9 65 32 1f df b6 86 9d b6 c9 6c 78 1c b4 86 dd ae c9 22 78 1c f6 4f da 1d 93 79 f0 d8 e9 f4 da 27 e6 e9 34 f0 a3 b8 36 1d d7 9b 2c b2 ce d7 66 dd 98 50 77 Data Ascii: bF(+6&7)V3~mDS4Jb(o_v@]]]2VEqNc~{7w#Obo\?4X\}<<`ZU4?fv:g1r10X-cdyzkpOnd.<ve2lx"xOy'46,fPw
2024-04-26 17:12:54 UTC	1260	IN	Data Raw: 76 c1 48 0a 03 c5 4a 29 00 16 ab a1 f1 3f 2c 34 f2 e0 6a 31 c4 2b e1 b8 2b d7 41 96 52 d9 56 b5 42 f0 2a 53 e6 89 16 04 b5 b4 29 31 73 bd 29 b9 16 5a 53 49 7e 4d f8 8a cf f9 d7 6a 07 d2 6f 72 d1 93 12 c9 42 6b 45 b2 6b 4b 09 89 73 67 39 59 28 f9 31 77 72 3f ad dc e9 0d b9 6d e8 c3 a7 b7 57 78 13 ad f5 39 a4 85 8b e0 a6 57 29 c0 9c 76 4d b0 f4 0e 81 b3 03 dc 33 1c 37 bd 6b f5 4e ef d7 c5 2c 37 8e e0 7e f4 b2 fa fb cc 5a db 40 ee ce 79 98 3a 28 c3 a2 c9 77 57 78 dd 8b 72 db 2a 0d 88 6d bd 95 59 a6 d8 86 18 d9 d1 74 cb 52 83 34 73 7b 1a e5 ae f6 0c 26 33 fe a3 d9 1c 74 27 98 dc 29 8b c4 92 0f db 84 95 89 b6 ac dd 19 f4 3a 55 57 79 c5 15 de 6e 9f a4 22 7e 7f dc 6a 36 53 ae d2 d6 05 19 74 7f 7d c7 67 f2 32 df 68 9a 21 67 25 8d 5d 6d 26 cc 65 9e 72 d4 59 24 96 Data Ascii: vHJ)?,4j1++ARVBS)1s)ZSI~MjorBkEkKsg9Y(1wr?mWx9W)vM37kN,7~Z@y:(wWxrmYtR4s{&3t'):UWyn"~j6St}g2h!g%]m&erY$
2024-04-26 17:12:54 UTC	16384	IN	Data Raw: 03 dc 34 32 44 44 64 f8 cf d8 a2 7b 0d ba b7 b9 e3 42 67 4b 3b 9e c3 d1 44 40 1d 19 92 df 92 94 05 be 43 5f 7b 38 b0 b7 dc 0f 1c c7 60 ce c8 78 d5 ea 59 dd 93 5a cb ea f6 3a 53 ab db 11 ff c1 ef 56 bb 87 3d 5a bd 5e d7 6b f4 ac 66 bb 5d c3 7f ed 4e ad 23 12 57 36 5a 56 a7 db b5 06 83 be d7 b0 80 0f b1 da ed be 6d 75 2c f5 d9 ea f4 07 f8 cf d0 c3 2f 58 a4 93 56 ae 41 bd 01 b5 d0 f7 a8 71 ec a2 75 62 43 bf d8 b7 2c 84 bd 43 85 57 9d 5a 7b 3e b0 06 2f 4f 6a 1d 6b f0 6d 27 ed a5 d9 c0 c7 db 13 ed 4d 0d 1f e7 b9 37 50 ec 87 a1 35 1c f6 bc 96 85 dd 0e 7e 68 75 ec 76 ad 2d 87 0a 4f df 66 7e 37 da 3f 74 d3 df 35 f8 6d b0 29 1c d2 ec fa 51 f6 42 04 2f 47 cb 3f 92 02 f9 f2 5f 14 c8 97 3b 81 7c 51 0d e4 cb 3f 1a c8 1d 00 72 e7 8f 00 f2 21 82 92 dd b5 7a 35 fc 9f d8 Data Ascii: 42DDd{BgK;D@C_{8`xYZ:SV=Z^kf]N#W6ZVmu,/XVAqubC,CWZ{>/Ojkm'M7P5~huv-Of~7?t5m)QB/G?_;\|Q?r!z5
2024-04-26 17:12:54 UTC	16384	IN	Data Raw: 63 91 5d 05 36 e9 24 0c ee 63 8a a3 fb 18 5a 86 07 a5 42 8b 7c d2 8a 91 a5 4d 4d 0e 37 81 6e 5b c3 10 89 3e e9 d0 cc c5 43 ee 6c b3 11 a6 ea b5 ee 4c 55 85 0d 06 13 a8 8c a6 1f f7 f7 93 fd fd 10 ee 88 02 90 d9 df c7 9c 02 5c 0e 57 54 ac 56 0c 73 8a 14 2f 71 9e 80 8b 94 ba 44 27 2c 73 41 21 79 bf 6d 7a ec e6 c8 1d c6 5b 5f 25 02 21 24 26 42 88 2c 08 c4 cf 5f 33 a9 86 37 f4 bc 34 e3 43 70 c2 2e 34 01 ca 8d 5e c5 6d 5b d0 19 cb 86 93 1f a0 36 5d 6d 68 f9 09 2a 93 df ed c6 d2 2e ca 71 de dd 5e e5 65 f2 03 d6 e3 d1 71 24 a3 49 18 9d e4 90 3f af 54 fe 59 a5 21 95 e3 bb ff f9 e6 26 de ac 2e ff 33 a4 a9 91 08 56 4a 21 e3 77 d5 30 eb c3 60 bf ee 07 be de aa ef ec fe 3e 95 8e 28 ee 03 f0 5a b1 da 8b 1b e8 b6 58 60 b2 47 5b 81 70 1a b4 18 e9 a6 41 25 f6 64 87 95 67 Data Ascii: c]6$cZB\|MM7n[>ClLU\WTVs/qD',sA!ymz[_%!$&B,_374Cp.4^m[6]mh*.q^eq$I?TY!&.3VJ!w0`>(ZX`G[pA%dg
2024-04-26 17:12:54 UTC	4238	IN	Data Raw: ca 5c d8 bb 53 62 08 ba 9c 16 be 83 ed 89 7d c3 76 f3 3b d6 d8 d5 a2 24 7b 3b 90 07 9e cb f4 1f d5 00 98 2a d2 7a 40 05 c4 cc b9 5c d2 ae 93 24 5e 31 a2 bf 3e 25 d4 db ef 0d 93 e3 75 8c 30 39 16 ab be 72 eb bd ad ed 6d 31 d5 60 1b a4 46 b4 8b 4f b3 64 ad e4 84 b1 49 03 f3 92 76 58 63 10 e5 a0 88 50 e7 db 08 e2 b2 09 19 e0 92 d4 43 21 20 1f 25 d2 f8 b8 2e 86 e3 2b 75 83 c6 c1 b7 ca 85 96 b9 88 0b d8 0d d7 48 e8 61 a6 72 42 3b af ef 4e 82 99 4d 54 b7 e7 7e eb fc 63 8a ff f6 28 e2 53 e3 d0 6b b0 04 c3 a0 d1 57 f7 f7 2b ff 2b da c3 7f fc 34 ec e1 70 e8 d3 0a 20 4d 4c fb 99 c7 9a f7 2e 99 38 eb e7 31 13 70 fd 42 55 e4 4b e7 69 c0 74 e5 af 96 4c d2 f5 31 66 b6 d7 e3 e7 2c c9 e6 e4 9a a9 cf a3 26 33 23 fa 54 96 75 93 69 c9 23 a9 05 d7 b3 6e b2 84 a4 0b 33 52 e1 Data Ascii: \Sb}v;${;*z@\$^1>%u09rm1`FOdIvXcPC! %.+uHarB;NMT~c(SkW++4p ML.81pBUKitL1f,&3#Tui#n3R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49773	13.226.52.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:53 UTC	509	OUT	GET /tooltips-modern.41f34148.js HTTP/1.1 Host: js.intercomcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:54 UTC	791	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 5172 Connection: close Date: Fri, 26 Apr 2024 17:12:55 GMT Last-Modified: Fri, 26 Apr 2024 10:35:29 GMT ETag: "c0a0eb66756de21372edd5e5f99f5df9" x-amz-server-side-encryption: AES256 Cache-Control: max-age=31536000, s-maxage=7200, public Content-Encoding: gzip x-amz-version-id: jSL9kS5Kan2HeRuHpfvYmOhmHqeLh7VR Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 bb707a876db211940a3cb07991cacbdc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: fe8gHjrukbBZToGqgsysz6T56Ta-82wojOiNGxpaIoYi8aLsbsitLA== Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cross-Origin-Resource-Policy: cross-origin
2024-04-26 17:12:54 UTC	5172	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e5 5b 7f 73 db 36 d2 fe 2a 34 db f1 90 73 10 4a 8a 22 25 d1 c7 66 1c 37 6e dc da 71 ea b8 e9 4d 3c 9e 84 22 21 8b 09 45 aa 24 64 c5 96 f4 dd 6f 77 41 52 3f ed e4 fe b8 77 e6 e6 6d 6b 09 04 16 d8 c5 62 f7 d9 5d 50 d5 a7 a5 d0 4a 59 24 91 d4 8f 8c bb 34 1f 84 e9 f5 28 29 f9 4c 0c 26 61 f4 e5 64 34 cd be 24 99 14 45 94 8f 3f 7e 2e 83 6f 93 2c 16 37 b7 26 9f 4c cb 91 71 73 d3 f3 1c f7 96 cd 5d c7 6d db be 21 98 64 b9 19 fc 3c cf 79 61 48 93 e5 3c 36 24 9b c7 62 18 4e 53 e9 1b 30 f4 2f 56 ca 87 54 bc c9 63 71 16 53 cf 1f 4c e6 79 2a 93 c9 5a df ef 4b f3 e8 3e 2c b4 2c c8 8d be e7 76 2c 93 25 d0 ec 58 7d cf 36 59 01 4d af db f1 ba 26 4b a1 d9 73 da 16 34 23 68 da 96 d3 eb 9b 2c 84 66 db ed 76 a1 b7 84 66 d7 f3 bc b6 c9 a6 38 ad 6d Data Ascii: [s64sJ"%f7nqM<"!E$dowAR?wmkb]PJY$4()L&ad4$E?~.o,7&Lqs]m!d<yaH<6$bNS0/VTcqSLyZK>,,v,%X}6YM&Ks4#h,fvf8m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49775	35.174.127.31	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:54 UTC	679	OUT	GET /pubsub/5-lply-f-VjGB-pLga11-efp0LSssuhSSwqyxVV9fMRaPOythrtG38Y2wFjZt7qmHSjq8ooW0zEhuw-bic1WNA-W0izXHhxBNjx1bP?X-Nexus-New-Client=true&X-Nexus-Version=0.12.12&user_role=visitor HTTP/1.1 Host: nexus-websocket-a.intercom.io Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://in.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: WOvgqIMGFX5HHq+s0IudqQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49777	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:55 UTC	534	OUT	GET /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=18937&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:12:55 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:12:55 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760071-MIA
2024-04-26 17:12:55 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49778	34.196.171.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:55 UTC	361	OUT	GET /messenger/web/ping HTTP/1.1 Host: api-iam.intercom.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:12:55 UTC	4209	IN	HTTP/1.1 406 Not Acceptable Date: Fri, 26 Apr 2024 17:12:55 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 144 Connection: close Status: 406 Not Acceptable Vary: Accept-Encoding Strict-Transport-Security: max-age=31556952; includeSubDomains; preload X-XSS-Protection: 1; mode=block X-Request-Id: 0003e4onvt7ao1khacs0 X-Runtime: 0.021792 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' docs.google.com fast.wistia.net fast.wistia.com js.stripe.com hooks.stripe.com platform.twitter.com player.vimeo.com staticxx.facebook.com www.facebook.com web.facebook.com www.loom.com play.vidyard.com web.microsoftstream.com share.synthesia.io embed.app.guidde.com share.descript.com app.guideflow.com www.youtube.com www.youtube-nocookie.com content.jwplatform.com players.brightcove.net intercom-sheets.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com gtm.intercom-marketing.com intercominc.typeform.com www.intercom-reporting.com insight.adsrvr.org apisandbox.zuora.com zuora.com www.zuora.com .my.connect.aws www.recaptcha.net intercom.help intercom-help.eu au.intercom.help sharepoint.com .sharepoint.com; connect-src 'self' app.intercom.com api-iam.intercom.io api-ping.intercom.io api-visitor-analytics.intercom.com nexus-websocket-a.intercom.io via.intercom.io wss://nexus-websocket-a.intercom.io nexus-europe-webso [TRUNCATED] Server: nginx
2024-04-26 17:12:55 UTC	144	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 22 6d 65 64 69 61 5f 74 79 70 65 5f 6e 6f 74 5f 61 63 63 65 70 74 61 62 6c 65 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 54 68 65 20 41 63 63 65 70 74 20 68 65 61 64 65 72 20 73 68 6f 75 6c 64 20 73 65 6e 64 20 61 20 6d 65 64 69 61 20 74 79 70 65 20 6f 66 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 7d 5d 2c 22 74 79 70 65 22 3a 22 65 72 72 6f 72 2e 6c 69 73 74 22 7d Data Ascii: {"errors":[{"code":"media_type_not_acceptable","message":"The Accept header should send a media type of application/json"}],"type":"error.list"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49779	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:12:56 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714151515024&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-26 17:12:56 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-26 17:12:56 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-26 17:12:57 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 104F247ED1184674AF0CF288DDA58BE6 Ref B: LAX311000108019 Ref C: 2024-04-26T17:12:57Z Date: Fri, 26 Apr 2024 17:12:57 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714151576.125fa284

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49805	13.249.98.6	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:06 UTC	556	OUT	GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:06 UTC	664	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 6759 Connection: close Date: Fri, 26 Apr 2024 17:13:07 GMT Last-Modified: Thu, 26 Oct 2023 12:27:20 GMT ETag: "15864ce88fa79a3e954417d0c3396798" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 e65779811ad331617179859160ead1b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: KLFKnFnrIvnFFWrULdnGNNXKyF8vwzOBdY9isCY7PaEB_HTKMIYqhA== X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2024-04-26 17:13:06 UTC	6759	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 5c eb 52 e3 48 96 fe 3f 4f 61 34 b1 6e 69 49 84 cd 1d b9 14 4c 15 45 4f b3 51 14 15 14 dd bd b3 2c 41 c8 56 da 64 b7 ac f4 48 e9 a2 68 e3 27 db 1f fb 48 fb 0a 7b 4e de 94 b2 25 a0 7a 66 22 66 23 b6 a3 a3 90 f2 9e 27 cf e5 3b 27 8f fc 3f ff f5 df 1b e3 79 3e 12 8c e7 9d dc e7 a4 24 45 b0 b0 25 89 2f 08 0d 16 6c ec 6f 94 37 e2 56 3d 71 f9 f4 25 29 3a 2c f6 4c 53 2f 8e c5 e3 8c f2 71 a7 a0 7f 9d b3 82 76 bb fa 61 80 7d e0 95 05 05 15 f3 22 ef 30 18 74 a3 17 60 79 66 ca 32 5d 26 ee 0b fe e0 d3 38 a7 0f 9d b3 a2 e0 85 ef 9d 26 79 ce 45 67 cc f2 b4 33 e5 e9 3c a3 9d ef bc 4d b1 e9 7d e7 05 41 38 e2 29 8d bd 8b cb f7 3f 7e 38 bb fb 78 79 7d f7 fd e5 8f 1f df 7b 84 2e 59 8c 4b 8e 17 f4 eb 8c 17 a2 8c 16 cb 25 c1 a5 df f4 6e c3 51 Data Ascii: \RH?Oa4niILEOQ,AVdHh'H{N%zf"f#';'?y>$E%/lo7V=q%):,LS/qva}"0t`yf2]&8&yEg3<M}A8)?~8xy}{.YK%nQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49807	3.215.173.78	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:06 UTC	711	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=C593280E560020957F000101%40AdobeOrg&d_nsid=0&ts=1714151583538 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:06 UTC	815	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:06 GMT Content-Type: application/json;charset=utf-8 Content-Length: 363 Connection: close X-TID: MOTxbfPsTOM= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-va6-1-v059-020678578.edge-va6.demdex.com 8 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:06 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:06 UTC	363	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"03549638624246876723885913874856506827","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49822	54.156.87.255	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:07 UTC	748	OUT	GET /dest5.html?d_nsid=0 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:07 UTC	604	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:07 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 6983 Connection: close X-TID: gBFJlClxRnE= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Accept-Ranges: bytes last-modified: Tue, 9 Apr 2024 11:57:47 GMT DCS: dcs-prod-va6-1-v059-011d1de90.edge-va6.demdex.com 0 ms
2024-04-26 17:13:07 UTC	6983	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 41 64 6f 62 65 20 41 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49821	63.140.39.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:07 UTC	735	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=C593280E560020957F000101%40AdobeOrg&mid=03549638624246876723885913874856506827&ts=1714151585555 HTTP/1.1 Host: xerolimited.sc.omtrdc.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:07 UTC	437	IN	HTTP/1.1 200 OK access-control-allow-origin: https://www.xero.com access-control-allow-credentials: true date: Fri, 26 Apr 2024 17:13:07 GMT p3p: CP="This is not a P3P policy" server: jag vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 2 cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-26 17:13:07 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49823	44.198.199.61	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:07 UTC	519	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=C593280E560020957F000101%40AdobeOrg&d_nsid=0&ts=1714151583538 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:07 UTC	710	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:07 GMT Content-Type: application/json;charset=utf-8 Content-Length: 363 Connection: close X-TID: 2zMwHeQPQqU= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-va6-1-v059-04b63e19d.edge-va6.demdex.com 2 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:07 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:07 UTC	363	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"03549638624246876723885913874856506827","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49820	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:07 UTC	700	OUT	POST /event?d_dil_ver=9.4&_ts=1714151585356 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 725 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:07 UTC	725	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 35 38 35 33 35 36 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 75 74 6d 5f 73 6f 75 72 63 65 3d 78 65 72 6f 2d 69 6e 76 6f 69 63 65 26 Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151585356&d_rtbd=json&d_jsonv=1&d_dst=1&c_utm_source=xero-invoice&
2024-04-26 17:13:07 UTC	819	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:07 GMT Content-Type: application/json;charset=utf-8 Content-Length: 231 Connection: close X-TID: T/erzQoJSdo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-2-v056-0f281a560.edge-usw2.demdex.com 200 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:07 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:07 UTC	231	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 54 2f 65 72 7a 51 6f 4a 53 64 6f 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"T/erzQoJSdo="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49815	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:07 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Ko3zU8Hd5ZVTmFn&MD=l8GhsYuk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 17:13:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: f10ac6e2-8819-4633-a5c1-9c05560e0754 MS-RequestId: 6fbe0e61-d739-42c1-a14b-71d8c5d5d08a MS-CV: 2g/84C445UGzRqEz.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:13:06 GMT Connection: close Content-Length: 25457
2024-04-26 17:13:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 17:13:07 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49825	13.249.98.79	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:07 UTC	802	OUT	GET /trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:07 UTC	649	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 3267 Connection: close Date: Fri, 26 Apr 2024 17:13:08 GMT Last-Modified: Mon, 30 Oct 2023 13:11:24 GMT ETag: "2922a85ce6caf46f828c097bf7aa1036" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 a782b2219163c48526f5b10315d332fa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: 2WmljXtba3Kidbm5_Bp043Zv7N9Uydcx1ObB8Vlsz_vithbTNaiYvg== X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2024-04-26 17:13:07 UTC	3267	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 c5 5b eb 8f db b8 11 ff 7e 7f 85 ce c1 01 d9 96 da d8 de b5 b3 91 37 41 db eb 15 57 20 68 0b dc 01 45 3f 2d 28 89 b2 79 2b 4b 8a 48 39 bb 31 fc bf 77 86 d4 83 92 28 f9 b1 7b 2d 9c 8d 25 3e 86 3f 0e 87 f3 22 7d ff fd 5f ff f9 e3 af ff f9 d7 4f ce 46 6e e3 4f df dd eb 2f c7 b9 df 30 1a e2 03 3c 6e 99 a4 4e b0 a1 b9 60 f2 e3 a4 90 91 7b 37 71 de 99 95 09 dd b2 8f 93 3c f5 53 29 26 4e 90 26 92 25 d0 34 49 79 12 b2 a7 a6 b1 e4 32 66 9f 7e cd 0b 21 33 1e a7 d2 f9 11 9e d2 ad f3 6f 1e ae 99 bc 7f a7 eb 75 5b 21 9f f1 19 01 11 3f 0d 9f 49 c8 77 44 64 34 21 34 cb 62 26 49 ea ff c6 02 49 78 94 c3 e8 64 33 23 9b 39 d9 dc 90 cd 2d d9 2c c8 66 49 32 e2 c7 69 f0 f8 a5 48 25 23 59 ce 08 25 d4 f7 73 42 83 3c 4d 9e b7 84 86 61 ce 84 20 3e 5f Data Ascii: [~7AW hE?-(y+KH91w({-%>?"}_OFnO/0<nN`{7q<S)&N&%4Iy2f~!3ou[!?IwDd4!4b&IIxd3#9-,fI2iH%#Y%sB<Ma >_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49827	3.215.173.78	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:07 UTC	932	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=C593280E560020957F000101%40AdobeOrg&d_nsid=0&d_mid=03549638624246876723885913874856506827&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&ts=1714151586550 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:08 UTC	815	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:08 GMT Content-Type: application/json;charset=utf-8 Content-Length: 363 Connection: close X-TID: Zb5zB5wsQs8= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-va6-2-v059-095cc0498.edge-va6.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:08 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:08 UTC	363	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"03549638624246876723885913874856506827","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49829	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:08 UTC	700	OUT	POST /event?d_dil_ver=9.4&_ts=1714151586619 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 249 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:08 UTC	249	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 35 38 36 36 31 39 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 61 6e 64 6f 6d 5f 6e 75 6d 5f 74 65 73 74 3d 32 31 Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151586619&d_rtbd=json&d_jsonv=1&d_dst=1&c_random_num_test=21
2024-04-26 17:13:08 UTC	817	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:08 GMT Content-Type: application/json;charset=utf-8 Content-Length: 231 Connection: close X-TID: Sl1SyK9JR50= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-2-v056-08e331d72.edge-usw2.demdex.com 6 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:08 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:08 UTC	231	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 53 6c 31 53 79 4b 39 4a 52 35 30 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"Sl1SyK9JR50="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49830	13.249.98.79	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:08 UTC	692	OUT	GET /trustboxes/53aa8912dec7e10d38f59f36/main.js HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:08 UTC	665	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 31409 Connection: close Date: Fri, 26 Apr 2024 17:13:09 GMT Last-Modified: Mon, 30 Oct 2023 13:11:26 GMT ETag: "60fe166092712d93cc87039640675ef6" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 5531c4e0d08c7a873b3e6cdf8791af40.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: eszfIxfmtjL40m-rD6sXAPGd8xwPcHnNkbxj0x4_IkHeKGRlWC4WhQ== X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2024-04-26 17:13:08 UTC	15719	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 7b 97 1b d7 75 27 fa 55 8a e5 19 12 70 17 40 14 de a8 26 d4 43 51 94 45 a7 49 6a 48 4a ce 75 bb c3 55 0d 9c 6e 14 bb 50 05 57 15 ba d9 dd c4 5a a2 14 cf 38 e3 64 bc 6e 5e 93 2c e7 71 9d c8 49 94 dc 49 9c c4 9e c8 72 e2 ac 35 1c ff 4f 7d 85 a1 2d 3b 7f dd af 70 7f fb 3c aa 4e 01 05 74 37 45 c9 c9 bd a2 ec 46 d5 79 ec b3 cf 3e fb 79 5e f5 ff fc f0 9f 2f ec 4e 83 41 e2 85 81 e1 95 02 cb b5 e2 f2 49 9a 12 96 12 8b 95 4f bc dd d2 05 77 2b d9 16 4f 01 7f 3a 70 23 23 ea 9b aa a8 d9 ef 27 47 13 16 ee 1a 11 fb ea d4 8b d8 c5 8b f2 61 9d ea d0 6b 39 62 c9 34 0a 8c 08 40 2f d4 ca 94 ee ab 34 5f a6 25 a3 28 3c 2c b1 7e c0 0e 8d eb 51 14 46 25 f3 9a 1b 04 61 62 ec 7a c1 d0 18 87 c3 a9 cf 8c 4b e6 5a b2 66 5e 32 cb e5 ea 20 1c b2 be Data Ascii: {u'Up@&CQEIjHJuUnPWZ8dn^,qIIr5O}-;p<Nt7EFy>y^/NAIOw+O:p##'Gak9b4@/4_%(<,~QF%abzKZf^2
2024-04-26 17:13:08 UTC	1706	IN	Data Raw: d3 61 35 37 8e 40 76 56 5e 47 fa a0 7a e8 25 a3 4d 3e fc 65 58 ce d9 8c a8 3a e9 9b 52 2d df a7 a0 d7 67 5c 15 dd df ed 75 dd 41 a7 b3 63 5a e3 45 ef aa 9f 1f 06 a5 9e 27 dc a1 b9 78 d1 06 d5 13 29 04 1b 6c 6b b2 0d 2d 6c ed 65 60 bc 82 81 56 90 33 b6 79 23 f0 92 1b 43 b8 4b 4c 0d 2f eb 17 04 41 10 ad 93 59 26 50 ac 0c 43 98 a4 36 22 2a 3f 7a 74 9e 7b a6 bd 85 7b a6 3d 78 4f d6 96 99 c7 0a 86 5c e0 64 6e 97 a1 3a 39 f7 44 8c 9a b9 35 f5 7d 37 3a 7a 93 34 5f 0c 2a 97 4e f2 35 9d 44 0d 79 34 b3 98 75 22 86 9d 6e c8 9e a5 be 1b c0 b9 2a 30 2c 43 f6 13 b2 c9 a3 ac f3 b1 e8 7a d8 b7 17 74 ce c5 8b 82 ef a1 66 33 85 63 6f 5f bc a8 bf 21 7c ad 9f ad 66 7d 7b 43 7f 71 bc f5 55 03 27 19 5b 1f 32 38 95 52 22 21 bd 44 f8 9b 61 a4 6c 1f c6 93 ca b9 43 3d cd 85 c0 24 Data Ascii: a57@vV^Gz%M>eX:R-g\uAcZE'x)lk-le`V3y#CKL/AY&PC6"?zt{{=xO\dn:9D5}7:z4_N5Dy4u"n*0,Cztf3co_!\|f}{CqU'[28R"!DalC=$
2024-04-26 17:13:08 UTC	12792	IN	Data Raw: 53 7a 56 0e a6 d3 e0 5f 0e cc 43 71 1a bc 77 2f 5a 91 fc 1b 99 ac 0b fa 4b 1c 38 88 04 62 c3 0c 32 7c 10 2b e2 69 28 64 2d 84 90 59 77 44 5c 92 e8 f3 3d d2 25 a5 28 65 dd ab 66 81 63 5f 7f a1 80 00 46 57 0f 24 29 c0 37 39 49 4d ea 2d 9f 25 50 81 25 4d 06 58 cb c2 54 8f 7c 29 3e f7 2e f6 27 0a e5 2c 17 5f 53 65 2d 57 7f fd 6c be 92 b8 4e 71 9a d8 73 05 a0 b4 0b 24 8c f8 32 31 f8 8d 95 57 6d 4e e4 a3 3e e8 9b b7 c2 f4 e2 43 f7 c0 f5 7c c2 d8 a4 75 d1 a0 34 b4 b6 4e 80 9d 63 a2 a7 31 3a 7f 47 ed f1 14 bc 33 ef c9 43 6f 8f bc 78 21 9e 4b c7 29 92 33 f5 0a 4e 69 b9 cf 9e 88 b9 4e 98 a5 c8 9d 5c 8d f6 62 2b 5b 98 89 b4 95 28 b5 2c 34 bf 72 14 cd af 45 cd 2f 24 51 34 ab f7 a9 ba 83 d8 11 1e 2d 57 39 4b 96 64 a1 fa 07 e5 e7 43 70 6b 7b 1e 43 70 d0 39 70 5a 17 93 Data Ascii: SzV_Cqw/ZK8b2\|+i(d-YwD\=%(efc_FW$)79IM-%P%MXT\|)>.',_Se-WlNqs$21WmN>C\|u4Nc1:G3Cox!K)3NiN\b+[(,4rE/$Q4-W9KdCpk{Cp9pZ
2024-04-26 17:13:08 UTC	1192	IN	Data Raw: a4 73 9a d4 bc f0 ef c5 24 cc a7 9f 66 72 c0 33 a8 35 33 27 4d 99 28 35 53 66 0d b8 2a 48 57 b2 52 16 e6 cc bf 7f bf 79 38 d8 3a c3 c7 00 3c ed 7d 90 84 a3 61 38 fd a4 99 db 7b 3b 9b 83 5d 1e be 1d 5d 07 e1 94 45 bc df dc dd ed 1f 9c 89 ea 30 13 1e fc 3d e0 55 f2 a6 6d 1e 0d f6 58 ee b3 cd fd 81 a7 0d b0 99 14 66 2c 65 73 16 42 41 c7 87 83 dd fe e1 e1 d9 0f 7d 28 70 13 1a 2e 5a c1 11 f8 01 cd 3e a0 9f 8c 59 c5 c3 fe 0f 9b 5b ff 38 3b de 1d fc ed b8 cf 93 0e c9 65 30 ba 03 54 81 43 b3 54 4a b4 1c d1 df 79 df df de 86 4a 6a ea 3d fb b0 77 b0 e3 69 7d 58 25 8d c7 64 5c d9 88 0f b0 02 91 4a 92 ea 2a e4 ce 2b 66 59 7e 1a 6c fd 74 78 b4 79 00 70 fd 14 8e 3e 71 a3 f5 d6 de fe 3f ce f6 37 0f 8f fa 67 39 68 9e b6 15 cd 80 1e 92 94 e4 a0 69 e6 87 c1 b0 7f 76 bc 3f Data Ascii: s$fr353'M(5SfHWRy8:<}a8{;]]E0=UmXf,esBA}(p.Z>Y[8;e0TCTJyJj=wi}X%d\J+fY~ltxyp>q?7g9hiv?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49836	63.140.39.15	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:08 UTC	488	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=C593280E560020957F000101%40AdobeOrg&mid=03549638624246876723885913874856506827&ts=1714151585555 HTTP/1.1 Host: xerolimited.sc.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:08 UTC	378	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Fri, 26 Apr 2024 17:13:08 GMT p3p: CP="This is not a P3P policy" server: jag vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 2 cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-26 17:13:08 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49837	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:08 UTC	431	OUT	GET /event?d_dil_ver=9.4&_ts=1714151585356 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:08 UTC	892	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:08 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: BluK2dEPSNI= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-077d12c14.edge-va6.demdex.com 27 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:08 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:08 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:08 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49841	44.198.199.61	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:08 UTC	685	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=C593280E560020957F000101%40AdobeOrg&d_nsid=0&d_mid=03549638624246876723885913874856506827&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&ts=1714151586550 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:08 UTC	710	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:08 GMT Content-Type: application/json;charset=utf-8 Content-Length: 363 Connection: close X-TID: 99CSjiK5RrE= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-va6-2-v059-05484fc6f.edge-va6.demdex.com 2 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:08 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:08 UTC	363	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"03549638624246876723885913874856506827","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49847	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:08 UTC	431	OUT	GET /event?d_dil_ver=9.4&_ts=1714151586619 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:09 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:09 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: xbZd2WPGTk8= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-02acdc9d6.edge-va6.demdex.com 8 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:09 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:09 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:09 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49845	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:08 UTC	700	OUT	POST /event?d_dil_ver=9.4&_ts=1714151586622 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 247 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:08 UTC	247	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 35 38 36 36 32 32 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 61 6e 64 6f 6d 5f 6e 75 6d 62 65 72 3d 37 30 Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151586622&d_rtbd=json&d_jsonv=1&d_dst=1&c_random_number=70
2024-04-26 17:13:09 UTC	817	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:09 GMT Content-Type: application/json;charset=utf-8 Content-Length: 231 Connection: close X-TID: DX1LD88nRKc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-0dfafab7b.edge-usw2.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:09 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:09 UTC	231	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 44 58 31 4c 44 38 38 6e 52 4b 63 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"DX1LD88nRKc="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49851	13.249.98.79	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	864	OUT	GET /trustbox-data/53aa8912dec7e10d38f59f36?businessUnitId=4becd84a00006400050b6782&locale=en-NZ&reviewStars=4%2C5&reviewTagValue=product&includeReviews=true&reviewsPerPage=15 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:09 UTC	570	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 12125 Connection: close Cache-Control: public,max-age=1800 Date: Fri, 26 Apr 2024 17:13:08 GMT ETag: "102a79c29cfd0efc8d1dced2870adfb4" Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 5531c4e0d08c7a873b3e6cdf8791af40.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: Djhm-DYh__utL5p_T805PskfYIlEkACHavIz-0GrXK8VqPQ-T1beVw==
2024-04-26 17:13:09 UTC	12125	IN	Data Raw: 7b 22 62 75 73 69 6e 65 73 73 55 6e 69 74 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 6f 72 65 22 3a 34 2e 32 2c 22 64 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 58 65 72 6f 22 2c 22 6e 75 6d 62 65 72 4f 66 52 65 76 69 65 77 73 22 3a 7b 22 74 6f 74 61 6c 22 3a 36 35 35 36 2c 22 6f 6e 65 53 74 61 72 22 3a 39 31 31 2c 22 74 77 6f 53 74 61 72 73 22 3a 32 37 37 2c 22 74 68 72 65 65 53 74 61 72 73 22 3a 33 39 35 2c 22 66 6f 75 72 53 74 61 72 73 22 3a 36 33 35 2c 22 66 69 76 65 53 74 61 72 73 22 3a 34 33 33 38 7d 2c 22 77 65 62 73 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 22 7d 2c 22 62 75 73 69 6e 65 73 73 45 6e 74 69 74 79 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 Data Ascii: {"businessUnit":{"stars":4.0,"trustScore":4.2,"displayName":"Xero","numberOfReviews":{"total":6556,"oneStar":911,"twoStars":277,"threeStars":395,"fourStars":635,"fiveStars":4338},"websiteUrl":"https://www.xero.com/"},"businessEntity":{"stars":4.0,"trustSc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49850	13.249.98.79	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	1302	OUT	GET /stats/TrustboxImpression?locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=4becd84a00006400050b6782&widgetId=53aa8912dec7e10d38f59f36 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:09 UTC	459	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Fri, 26 Apr 2024 17:13:08 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 20e39984fc1932e2a15b23334116f65c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: qdAh7QgyXK-KiTG8EPOCFHNwL2CASKJzJlb7ZiMzNfX9jske-OGtnQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49854	3.215.173.78	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	661	OUT	GET /ibs:dpid=411&dpuuid=ZivgpAAAALmmJAN- HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661
2024-04-26 17:13:09 UTC	889	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:09 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: o/3YehXNQ7E= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-01d8efcc3.edge-va6.demdex.com 2 ms set-cookie: dpm=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:09 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:09 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:09 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49856	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151586622 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:10 UTC	892	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:09 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: YXQ/PzrCTgg= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-0dc1ef369.edge-va6.demdex.com 11 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:09 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:09 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:10 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49858	18.64.174.79	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	517	OUT	GET /20923.js HTTP/1.1 Host: www.dwin1.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:10 UTC	740	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 47800 Connection: close Date: Fri, 26 Apr 2024 17:13:11 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 08:52:50 GMT ETag: "e8fda4642d059d5ab863a2f161e4b14c" x-amz-server-side-encryption: AES256 Cache-Control: max-age=600, s-maxage=600 x-amz-version-id: gdWF4z39mAkq912_PWSVDK4bEL42MEYJ Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 f15eb807b2bdfbab7702d75e3a4f00c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: oxms8th4AU29a9sBwA38LPImuxa0N0sQCful8CBLjLUhcuzPxv-iZQ==
2024-04-26 17:13:10 UTC	7378	IN	Data Raw: 76 61 72 20 41 57 49 4e 3d 41 57 49 4e 7c 7c 7b 7d 3b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 7c 7c 7b 7d 2c 41 57 49 4e 2e 73 50 72 6f 74 6f 63 6f 6c 3d 22 68 74 74 70 73 3a 22 3d 3d 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 3f 22 68 74 74 70 73 3a 2f 2f 22 3a 22 68 74 74 70 3a 2f 2f 22 2c 41 57 49 4e 2e 69 53 63 72 69 70 74 43 6f 75 6e 74 3d 30 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 64 65 76 69 63 65 39 55 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 73 63 69 65 6e 63 65 62 65 68 69 6e 64 65 63 6f 6d 6d 65 72 63 65 2e 63 6f 6d 2f 64 39 63 6f 72 65 22 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 66 6c 61 67 73 3d 7b 61 6c 6c 6f 77 4e 65 77 41 57 43 43 6f 6f 6b 69 65 3a 21 30 2c 61 6c 6c 6f 77 4e Data Ascii: var AWIN=AWIN\|\|{};AWIN.Tracking=AWIN.Tracking\|\|{},AWIN.sProtocol="https:"==location.protocol?"https://":"http://",AWIN.iScriptCount=0,AWIN.Tracking.device9Url="https://the.sciencebehindecommerce.com/d9core",AWIN.Tracking.flags={allowNewAWCCookie:!0,allowN
2024-04-26 17:13:10 UTC	16384	IN	Data Raw: 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 65 2b 3d 6e 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6d 67 22 29 3b 74 2e 73 72 63 3d 65 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 62 6f 64 79 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 68 69 64 65 45 6c 65 6d 65 6e 74 28 74 29 7d 29 29 7d 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 73 63 72 69 70 74 41 70 70 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 2c 61 29 7b 69 66 28 21 65 7c 7c 21 6e 29 7b 76 61 72 20 69 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 69 66 28 69 2e 74 Data Ascii: ,(function(n){e+=n;var t=document.createElement("img");t.src=e,document.getElementsByTagName("body")[0].appendChild(t),AWIN.Tracking.hideElement(t)}))},AWIN.Tracking.scriptAppend=function(e,n,t,r,a){if(!e\|\|!n){var i=document.createElement("script");if(i.t
2024-04-26 17:13:10 UTC	16384	IN	Data Raw: 30 6e 6f 74 25 32 30 6e 65 65 64 65 64 25 32 43 25 32 30 69 66 72 61 6d 65 25 32 30 69 73 25 32 30 68 69 64 64 65 6e 25 32 30 61 6c 72 65 61 64 79 25 30 41 25 30 39 25 30 39 25 30 39 25 30 39 25 37 44 25 30 41 25 30 39 25 30 39 25 30 39 25 32 39 25 33 42 25 30 41 25 30 39 25 30 39 25 37 44 25 30 41 25 30 39 25 37 44 25 33 42 25 30 41 25 30 39 76 61 72 25 32 30 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 44 65 6c 69 6d 69 74 65 72 25 32 30 25 33 44 25 32 30 66 75 6e 63 74 69 6f 6e 25 32 30 25 32 38 63 75 72 72 65 6e 74 55 72 6c 25 32 39 25 32 30 25 37 42 25 30 41 25 30 39 25 30 39 72 65 74 75 72 6e 25 32 30 63 75 72 72 65 6e 74 55 72 6c 2e 69 6e 64 65 78 4f 66 25 32 38 25 32 37 25 33 46 25 32 37 25 32 39 25 32 30 25 33 44 25 33 44 25 33 44 25 32 30 Data Ascii: 0not%20needed%2C%20iframe%20is%20hidden%20already%0A%09%09%09%09%7D%0A%09%09%09%29%3B%0A%09%09%7D%0A%09%7D%3B%0A%09var%20getQueryParameterDelimiter%20%3D%20function%20%28currentUrl%29%20%7B%0A%09%09return%20currentUrl.indexOf%28%27%3F%27%29%20%3D%3D%3D%20
2024-04-26 17:13:10 UTC	7420	IN	Data Raw: 4c 49 44 43 6f 6f 6b 69 65 22 29 29 7b 76 61 72 20 6c 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 5f 67 65 74 47 43 4c 49 44 56 61 6c 75 65 28 29 2c 64 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 5f 67 65 74 41 57 61 69 64 56 61 6c 75 65 28 29 3b 6e 75 6c 6c 21 3d 3d 6c 26 26 6e 75 6c 6c 21 3d 3d 64 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 6f 28 75 28 22 47 43 4c 49 44 22 2c 74 3d 41 28 74 29 2c 7b 61 77 63 3a 22 67 63 6c 69 64 5f 22 2b 6e 2b 22 5f 22 2b 65 7d 29 29 7d 28 6c 2c 64 2c 65 29 7d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 53 61 6c 65 26 26 65 26 26 28 41 57 49 4e 2e 53 61 6c 65 51 75 65 72 79 53 74 72 69 6e 67 42 75 69 6c 64 65 72 2e 61 64 64 50 61 72 61 6d 65 74 65 72 28 22 6a 22 2c 65 2e 69 64 29 2c 65 2e 69 64 3d 69 2e 69 6e Data Ascii: LIDCookie")){var l=AWIN.Tracking._getGCLIDValue(),d=AWIN.Tracking._getAWaidValue();null!==l&&null!==d&&function(e,n,t){o(u("GCLID",t=A(t),{awc:"gclid_"+n+"_"+e}))}(l,d,e)}AWIN.Tracking.Sale&&e&&(AWIN.SaleQueryStringBuilder.addParameter("j",e.id),e.id=i.in
2024-04-26 17:13:10 UTC	234	IN	Data Raw: 2e 65 6e 68 61 6e 63 65 64 54 72 61 63 6b 69 6e 67 3d 21 30 29 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 53 74 6f 72 61 67 65 50 72 6f 76 69 64 65 72 3f 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 53 74 6f 72 61 67 65 50 72 6f 76 69 64 65 72 2e 67 65 74 28 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 67 65 74 43 6f 6f 6b 69 65 73 41 73 53 74 72 69 6e 67 28 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 72 75 6e 28 65 29 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 72 75 6e 53 63 72 69 70 74 73 28 29 7d 29 29 3a 28 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 72 75 6e 28 29 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 72 75 6e 53 63 72 69 70 74 73 28 29 29 3b Data Ascii: .enhancedTracking=!0),AWIN.Tracking.StorageProvider?AWIN.Tracking.StorageProvider.get(AWIN.Tracking.getCookiesAsString(),(function(e){AWIN.Tracking.run(e),AWIN.Tracking.runScripts()})):(AWIN.Tracking.run(),AWIN.Tracking.runScripts());

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49860	13.249.98.6	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	515	OUT	GET /trustbox-data/53aa8912dec7e10d38f59f36?businessUnitId=4becd84a00006400050b6782&locale=en-NZ&reviewStars=4%2C5&reviewTagValue=product&includeReviews=true&reviewsPerPage=15 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:10 UTC	569	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 12125 Connection: close Cache-Control: public,max-age=1800 Date: Fri, 26 Apr 2024 17:13:08 GMT ETag: "102a79c29cfd0efc8d1dced2870adfb4" Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e5775bd3de59bf76a539df64082141d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: V4kUP53Qo3FLQJwf0VZYwwTjW0Kut8iYOJeNnInni56QHTCKTVzV8A==
2024-04-26 17:13:10 UTC	12125	IN	Data Raw: 7b 22 62 75 73 69 6e 65 73 73 55 6e 69 74 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 6f 72 65 22 3a 34 2e 32 2c 22 64 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 58 65 72 6f 22 2c 22 6e 75 6d 62 65 72 4f 66 52 65 76 69 65 77 73 22 3a 7b 22 74 6f 74 61 6c 22 3a 36 35 35 36 2c 22 6f 6e 65 53 74 61 72 22 3a 39 31 31 2c 22 74 77 6f 53 74 61 72 73 22 3a 32 37 37 2c 22 74 68 72 65 65 53 74 61 72 73 22 3a 33 39 35 2c 22 66 6f 75 72 53 74 61 72 73 22 3a 36 33 35 2c 22 66 69 76 65 53 74 61 72 73 22 3a 34 33 33 38 7d 2c 22 77 65 62 73 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 22 7d 2c 22 62 75 73 69 6e 65 73 73 45 6e 74 69 74 79 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 Data Ascii: {"businessUnit":{"stars":4.0,"trustScore":4.2,"displayName":"Xero","numberOfReviews":{"total":6556,"oneStar":911,"twoStars":277,"threeStars":395,"fourStars":635,"fiveStars":4338},"websiteUrl":"https://www.xero.com/"},"businessEntity":{"stars":4.0,"trustSc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49859	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	528	OUT	GET /ads/pixel.js HTTP/1.1 Host: www.redditstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:10 UTC	1015	IN	HTTP/1.1 200 OK Connection: close Content-Length: 11214 Last-Modified: Wed, 24 Apr 2024 17:35:49 GMT ETag: "c4d61fbb6e730a840c7f140cbb9bcd06" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=60 Content-Encoding: gzip Content-Type: application/javascript Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:10 GMT Vary: Accept-Encoding,Origin Server: snooserv Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 d4 3b 6b 73 da c8 b2 7f 05 ab 4e 38 92 19 cb 80 b1 93 08 6b 5d 04 e4 98 8d 0d be 3c 9c 6c b9 58 4a 96 06 50 02 12 2b 89 38 be c0 fd ed b7 e7 25 8d 04 b6 93 b3 77 3f dc 54 0a cd 74 f7 f4 f4 6b 7a 7a 46 f2 c1 64 e5 3b b1 17 f8 85 50 c5 c8 47 b1 b6 4e 20 81 ea a1 89 b6 f6 26 ea 81 7f ef 8d 58 0b d3 d6 77 3b 2c 38 a6 22 48 15 d3 8c 9f 96 38 98 14 42 fc d7 ca 0b 71 b1 c8 1b 75 32 66 52 2c 3a 5a 88 e3 55 e8 17 1c 60 7a 50 d6 08 7c 25 60 2b 0e 23 5c 6d d3 c7 8f 05 2b 0c 83 50 55 9a b6 ef 07 71 61 e2 f9 6e 61 11 b8 ab 39 2e fc 5b 29 79 25 e5 df 8a 56 8f 67 61 f0 58 b0 75 27 70 b1 a9 dc 74 5b c3 6b 6b dc e9 0e c6 97 dd 61 a7 a5 20 7b 4b f8 2d 4d 22 bb b9 c6 3f 96 41 18 47 c6 7a bb ad 13 1d ee cb 23 dd b1 e7 73 75 a9 73 14 12 da a8 a1 Data Ascii: ;ksN8k]<lXJP+8%w?TtkzzFd;PGN &Xw;,8"H8Bqu2fR,:ZU`zP\|%`+#\m+PUqana9.[)y%VgaXu'pt[kka {K-M"?AGz#sus
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: 0d 3c 5f 55 48 15 b2 84 ae 14 0a 40 01 e3 52 e5 59 ff 9a 45 13 eb f0 d8 42 39 2f ca 94 c4 97 55 2d d5 ee 04 16 29 9d 88 78 90 73 81 cd 13 ec 0f 67 c1 aa 86 40 46 ba 76 bd 37 ef 0e 6b af fa 57 9e e9 b8 4a 72 fd 35 54 64 7e 85 bb 96 77 fe 31 ef ce 29 ff bf ef 60 89 0f 73 1e 73 98 3e 09 83 05 81 36 61 1b a0 6e 4f fd 27 0f 79 d6 85 8c 28 e3 c5 04 c4 1d 99 f4 9f f1 65 8e 9e 2a 25 ab b2 31 55 d0 a0 98 b2 71 b8 bc 8d 58 f5 34 e1 4b 50 f4 55 5f e6 66 22 ce 1c c6 93 77 dc 95 b4 f9 8a 23 a5 d2 de c5 64 eb 1c f6 da cd 60 b1 84 4c 04 c1 86 23 c7 5e 62 95 c5 84 b4 9b a6 0c b4 a4 dc 07 5e f9 52 ff c6 9e 83 0d 17 50 cd 0f 07 97 47 ef 0a ae 1d db 0a 11 32 67 f3 15 08 4a 2d ce 25 e1 f3 51 2a 75 e5 73 29 d8 d6 9e 91 4f 0c d4 08 d3 0f ab c9 04 87 d8 fd 30 0f 9c 6f 8d f9 34 Data Ascii: <_UH@RYEB9/U-)xsg@Fv7kWJr5Td~w1)`ss>6anO'y(e%1UqX4KPU_f"w#d`L#^b^RPG2gJ-%Qus)O0o4
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: 40 7b d5 11 0d 88 92 43 7b 27 23 1a 17 25 97 f6 6a 23 1a 1e 25 4c 7b a7 23 1a 25 a5 09 ed 9d 8d 68 b0 94 a6 b4 f7 76 44 63 a6 34 db 94 69 b8 5e ee d4 43 2c db fd d4 a9 c6 27 4b 70 10 c4 f6 dc 7c 77 98 3f 56 31 ec 35 9e c4 80 cc 14 d8 a2 16 48 78 de 27 a4 60 d4 53 38 d9 57 aa ef e8 f9 3d 81 bf 39 a9 a6 22 dc 57 6a 25 35 41 95 ce 6a 30 ea fd f9 79 4d 1b b1 cc 38 99 07 b0 c8 52 e1 8e d3 e4 a5 c9 5c 4e 9f e3 92 0e cd 9e 0c cc da 61 7a 92 e0 b7 16 fb ca 4c b6 aa 5f 3c 04 f0 bc f3 ca 31 80 26 1d 29 4f 64 8f 01 50 65 35 73 79 2c 53 6a aa 0c 47 ca 32 52 0f ee a7 4c 0a 45 41 cd 0b 36 94 d4 09 0c fe ff b1 4c 38 fd 89 32 41 59 45 b8 40 2e 16 40 33 ba 57 78 2e 6a 76 3b fd 41 a3 33 e8 9b 19 d9 e9 4b b0 38 52 c8 85 27 b1 98 8c 65 10 40 91 37 c8 00 c6 51 4c 77 8b 2f 37 Data Ascii: @{C{'#%j#%L{#%hvDc4i^C,'Kp\|w?V15Hx'`S8W=9"Wj%5Aj0yM8R\NazL_<1&)OdPe5sy,SjG2RLEA6L82AYE@.@3Wx.jv;A3K8R'e@7QLw/7
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: 8f f1 a0 3b 4e 21 2c c9 8f f7 67 f9 f1 4f a7 79 c2 74 5f a2 27 f0 bf 95 ea c7 2f e6 fa 41 af fd f1 a3 d5 e3 9a d0 ed 14 b0 e4 a1 20 6a 79 f8 01 b2 be 75 6d 35 07 dd 0c dd b8 d9 ef 73 5a d2 54 f8 66 3c b0 be 0c 04 98 b4 29 1f 6a 87 46 bb d3 a7 0c 93 1e c3 59 5f 20 5d 31 04 6d 2a 5b f2 8f 7e 11 fd f6 3f 39 7e bc 7a f6 80 b2 ee bf 56 38 7c 82 fc 0c 89 25 ce 1e 43 fe 22 18 f1 7d 9b be 43 8a 58 d1 1d c9 43 38 08 38 93 ca e1 7b 4d c6 d1 5a 42 43 36 38 ce 5b 40 a9 09 b5 10 78 97 ee 09 69 2d 4a 88 92 2f c7 c8 99 a7 45 5e 8b 90 c9 c9 20 55 2b 29 ba 52 22 44 db 3a 57 5b df cb 70 1f 50 18 8a 5c d0 91 8b bf 21 b0 b9 24 df 26 50 ec 5d 35 95 c2 61 10 92 1e f9 47 a0 cb b9 17 9b 12 98 be fb 83 ba 5c 57 92 63 36 85 f0 93 fc 79 f5 42 22 36 28 ea be 32 da 26 22 b0 f2 7e 77 Data Ascii: ;N!,gOyt_'/A jyum5sZTf<)jFY_ ]1m*[~?9~zV8\|%C"}CXC88{MZBC68[@xi-J/E^ U+)R"D:W[pP\!$&P]5aG\Wc6yB"6(2&"~w
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: 3c 07 c3 0a 58 61 e4 35 7a 76 39 18 a7 6c 3e c9 fe 64 ae 7d ba 00 c1 d1 9b cc 6d 70 a5 d0 d1 b2 ec 56 72 1f 57 a5 2e cc e9 b7 e8 55 d5 db d9 ed c8 b9 24 b8 e6 a4 d1 70 fc 49 2e 02 03 98 5f 4e 07 e7 e1 ac f2 97 21 dc a7 f0 4e aa 8d 6c 9d 74 6c 67 f9 74 30 2a 93 0a 9f 2f 07 83 59 c2 aa 30 e4 30 99 c9 8b f7 0e b4 22 d9 55 d6 e2 60 ae 37 7a 19 50 b4 78 3d 90 cc 8f 92 ca 16 79 74 0c c7 f7 ed d1 c2 3e a0 4b 67 1d 61 bf 56 5e b9 1c 74 fb b9 f2 f9 34 e3 c2 e4 99 0f 93 fe 2d af c7 be 85 25 43 2e 05 b6 14 ab 63 d8 35 fd 5f 87 dd fd 7e f5 cb 91 51 1b 6c 37 9f c5 2f 31 46 1c 52 86 83 33 d8 76 67 60 58 9e 4d e7 52 b0 5a 6a 1e e8 a3 2e fd 02 73 1f 00 2b c2 81 79 65 bd 63 9c eb 57 40 66 a3 b1 e9 6c 7b c9 2e e8 9d 41 86 76 c6 a2 ed 6e b7 82 e2 11 4b af b5 89 2a f7 b1 5e Data Ascii: <Xa5zv9l>d}mpVrW.U$pI._N!Nltlgt0/Y00"U`7zPx=yt>KgaV^t4-%C.c5_~Ql7/1FR3vg`XMRZj.s+yecW@fl{.AvnK^
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: b6 9e 50 09 9d 68 11 54 7b 69 d4 48 a8 4b a6 23 57 14 28 7b b5 92 4f 55 7b fc d5 68 04 89 37 b0 bc 8d 7f e5 d5 f8 7a d4 ed 0d d2 9d d3 df 77 b7 7f 7c 9f 77 76 2e 86 22 49 b2 02 ab 9d b1 f6 68 31 dd 0c ab a3 b1 bc 7f 41 51 7b 30 ca b1 21 1a ef e1 fd 74 e9 e4 1a d0 54 a7 f2 91 5e 7c 20 79 6c 7f 70 23 67 5d a2 2b 64 31 fc ab bc 14 17 8b 24 e1 ba 57 83 5f 1b e8 8f 5e c3 b5 11 ac 1d b2 1d c5 46 70 78 db b5 6e 40 b3 e7 b5 f0 19 a3 cf 9d 59 86 35 ab 1f d0 b6 7a 29 52 e8 c5 57 46 f6 07 6b 61 b8 b4 48 ac db b5 dc 8e 38 50 0f c7 81 5e d9 b2 b9 76 1e 7e 38 06 ed 53 6c 3c e9 ee f8 39 c2 f2 32 42 7e 48 9e 05 10 b2 ff 41 a1 fc 3f 96 ef 2f d3 ea 61 39 cc 12 04 b3 fa 75 20 26 0c 8c 8d 1b a6 c4 e4 72 fc f0 71 99 de 19 37 e9 c2 5d ca c1 e6 76 86 3c 53 c3 b7 ae 91 33 c6 99 Data Ascii: PhT{iHK#W({OU{h7zw\|wv."Ih1AQ{0!tT^\| ylp#g]+d1$W_^Fpxn@Y5z)RWFkaH8P^v~8Sl<92B~HA?/a9u &rq7]v<S3
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: 56 c2 62 e8 8a 48 f0 1f 80 be 91 e7 c5 b8 3b 3a 5b d3 85 86 03 ff 27 fb 0c bc ab 7f de 5d d9 12 00 44 02 7f 5d 4e 57 70 96 06 ab fe c8 fe 7e 33 9d 7c 96 ac 7b ea e0 b1 d5 99 98 5c cf ce 26 f2 22 ce ea 65 d1 f1 7c d6 6e 16 bb a2 ba 2c ec 60 e6 d5 25 38 67 f3 82 2f e2 33 a5 15 79 fc a1 db ec f5 fb e7 f2 2e e8 49 43 68 fb 30 59 af 54 02 37 c9 b1 8e 49 e3 a8 14 0f e3 c9 f4 0a b9 cf 8b 18 10 a7 be 7f 7d 25 9c 9f bd 9e fb 7b da e3 93 0e f0 65 b4 67 c4 e4 00 f6 7a b5 90 b2 13 07 74 5a 0f 3a ed 2d f9 ab d3 ee af 74 5a 81 e7 4a 8f 45 9f c0 29 37 d3 a4 ae 2e 19 8e d9 7e 90 0c 6c 73 93 bd 67 5d 2b 51 c3 08 d2 5a 56 0c 8c 97 05 69 91 b0 17 1e bd 35 ee ad 72 87 81 a3 3a 6e 5e 24 04 ae 18 e8 59 24 ff 0d 02 08 c1 e4 94 c9 55 05 9f d2 81 e3 d0 5c af 4c 53 e5 9e 8b 31 88 Data Ascii: VbH;:[']D]NWp~3\|{\&"e\|n,`%8g/3y.ICh0YT7I}%{egztZ:-tZJE)7.~lsg]+QZVi5r:n^$Y$U\LS1
2024-04-26 17:13:10 UTC	1378	IN	Data Raw: 74 ac c6 d7 21 af 3d 1c 54 d4 de ac d2 5d 06 5e 73 f1 9d 58 ac 06 6b ad ea c2 38 27 3e fc 2d 38 b8 fb 52 9d d2 0e cf b2 16 93 9b 2b 37 1c e8 70 ea ef 89 aa 13 aa 3e be 12 51 90 84 bd 06 30 cb ea 21 1d ce f2 4d 6f e9 60 fa 86 97 74 f1 dc 93 72 65 30 64 79 81 0f bd 73 65 1d c3 6e 79 f4 f9 a8 3a a5 d9 b8 cf dd ec c3 fe 9b 05 2d 33 15 26 44 19 8a d7 10 a6 f9 b1 4f 8f d3 9c 11 f3 46 95 fb 54 b8 f0 36 20 6c 50 77 5c af b9 dc 45 0f eb f8 e5 ae 35 e0 ac d0 f0 5a 97 c0 76 94 41 16 52 72 57 c7 2f 22 61 ec 52 bf 28 bb ad aa 12 ba a0 98 5f e6 8a 02 df ea a9 94 b0 69 6a 33 b8 d7 e9 5f 3c 1c de 40 d8 db 9c b9 4c 0c 2b f4 b3 b0 30 8b 85 79 2e cd 50 b3 51 36 54 f7 0d d9 26 98 51 83 07 a3 ab 2a 4a 0d 00 a1 77 01 22 39 75 a6 97 33 33 b6 aa 49 8e fa d0 61 a5 dc ad 6d 69 d6 Data Ascii: t!=T]^sXk8'>-8R+7p>Q0!Mo`tre0dyseny:-3&DOFT6 lPw\E5ZvARrW/"aR(_ij3_<@L+0y.PQ6T&Q*Jw"9u33Iami
2024-04-26 17:13:10 UTC	190	IN	Data Raw: 73 b1 d0 72 e8 a6 23 da 2e 16 9b 6e 6b 6a e7 da f4 ed 82 f6 0c f8 a6 a2 54 52 20 02 c5 2d f6 0c bd a7 74 31 1b 5f 8b e1 3c e3 81 17 59 8b 5f d0 de 65 f3 71 6a d0 76 32 b7 bd da 73 9c b4 f6 b7 ca 56 bb 49 a1 0e 45 7b 39 27 cd b9 24 8a 6d d4 08 55 fa 98 f4 1b 3a 6b 19 57 6e db 03 29 a4 a0 c8 d4 02 24 5a a6 1e 90 4a 78 1a 4a 98 c5 63 11 ca a5 05 f8 da ec fd 6d 32 93 f0 4f 8f 44 7c cb 19 5f 66 9e e5 77 2a 14 c0 29 43 a7 51 ab 47 88 7e d2 2f 87 2f f8 a9 a1 bd 07 68 ab 3f 38 ef ce 47 b3 fb 36 a1 ef 05 d6 84 5f 83 35 5a 9c 36 7f e8 64 ad 7f f8 1f 4f 0d f9 40 4b 99 00 00 Data Ascii: sr#.nkjTR -t1_<Y_eqjv2sVIE{9'$mU:kWn)$ZJxJcm2OD\|_fw*)CQG~//h?8G6_5Z6dO@K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49857	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151586624 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 248 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:09 UTC	248	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 35 38 36 36 32 34 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 65 66 65 72 72 65 72 3d 6e 6f 74 2d 78 65 72 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151586624&d_rtbd=json&d_jsonv=1&d_dst=1&c_referrer=not-xero
2024-04-26 17:13:10 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:10 GMT Content-Type: application/json;charset=utf-8 Content-Length: 231 Connection: close X-TID: z6YXt/q+Q7g= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-2-v056-0f17483cf.edge-usw2.demdex.com 4 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:10 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:10 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:10 UTC	231	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 7a 36 59 58 74 2f 71 2b 51 37 67 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"z6YXt/q+Q7g="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49861	44.198.199.61	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:09 UTC	473	OUT	GET /ibs:dpid=411&dpuuid=ZivgpAAAALmmJAN- HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; dpm=03520006604032765583882684969024465661
2024-04-26 17:13:10 UTC	889	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:10 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: F1iDInm4SIc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-0ea2ea65b.edge-va6.demdex.com 2 ms set-cookie: dpm=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:10 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:10 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-26 17:13:10 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49864	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:10 UTC	602	OUT	GET /ads/conversions-config/v1/pixel/config/t2_ewwvmnuh_telemetry HTTP/1.1 Host: www.redditstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:10 UTC	868	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86 access-control-allow-origin: * cache-control: max-age=300 content-type: application/json Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:10 GMT Via: 1.1 varnish Vary: Accept-Encoding,Origin Server: snooserv Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
2024-04-26 17:13:10 UTC	86	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 5f 68 61 73 68 22 3a 22 35 38 31 64 33 35 39 64 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 64 64 69 74 73 74 61 74 69 63 2e 63 6f 6d 2f 61 64 73 2f 35 38 31 64 33 35 39 64 2f 70 69 78 65 6c 2e 6a 73 22 7d Data Ascii: {"version_hash":"581d359d","url":"https://www.redditstatic.com/ads/581d359d/pixel.js"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49865	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:10 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151586624 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:10 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:10 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: c/+ojL8mQAk= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-07261d572.edge-va6.demdex.com 7 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:10 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:10 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:10 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49869	172.64.144.225	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:10 UTC	709	OUT	GET /attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals&e=undefined HTTP/1.1 Host: tracking.g2crowd.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	1261	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:11 GMT Content-Type: text/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=600, public set-cookie: _session_id=eef7483c5c58c254b56a96a7aacb6ff9; path=/; expires=Fri, 10 May 2024 17:13:11 GMT; HttpOnly; secure; SameSite=None etag: W/"3dae93a05edd9dcfc1864b87178a31e0" x-request-id: c88400ac-fbdb-4771-acad-9a0540adbd2b x-runtime: 0.004005 strict-transport-security: max-age=604800 x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block x-download-options: noopen x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin content-security-policy: default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com vary: Origin CF-Cache-Status: DYNAMIC
2024-04-26 17:13:11 UTC	322	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 73 4b 66 66 61 63 58 62 35 33 75 5f 51 4a 74 34 6a 4c 53 43 59 5a 35 48 71 38 4f 67 38 68 30 62 6f 7a 6b 57 42 56 47 41 49 4c 34 2d 31 37 31 34 31 35 31 35 39 31 2d 31 2e 30 2e 31 2e 31 2d 51 4b 45 4a 66 42 2e 41 62 77 63 2e 30 51 59 75 38 50 44 5a 62 47 32 57 49 53 42 51 6f 41 67 61 44 4e 65 64 33 54 71 4b 48 76 76 72 66 74 5a 65 74 37 38 45 4b 67 31 75 72 69 45 36 56 68 51 30 7a 47 4d 72 6d 65 57 78 43 43 55 67 38 2e 74 58 58 41 6c 4e 33 51 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 32 36 2d 41 70 72 2d 32 34 20 31 37 3a 34 33 3a 31 31 20 47 4d 54 3b 20 64 6f 6d 61 69 6e 3d 2e 67 32 63 72 6f 77 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 Data Ascii: Set-Cookie: __cf_bm=sKffacXb53u_QJt4jLSCYZ5Hq8Og8h0bozkWBVGAIL4-1714151591-1.0.1.1-QKEJfB.Abwc.0QYu8PDZbG2WISBQoAgaDNed3TqKHvvrftZet78EKg1uriE6VhQ0zGMrmeWxCCUg8.tXXAlN3Q; path=/; expires=Fri, 26-Apr-24 17:43:11 GMT; domain=.g2crowd.com; HttpOnly; Secure;
2024-04-26 17:13:11 UTC	22	IN	Data Raw: 31 30 0d 0a 2f 2f 20 54 72 61 63 6b 69 6e 67 20 46 69 6c 65 0d 0a Data Ascii: 10// Tracking File
2024-04-26 17:13:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49870	157.240.14.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:10 UTC	533	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	1465	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2024-04-26 17:13:11 UTC	1496	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2024-04-26 17:13:11 UTC	1	IN	Data Raw: 2f Data Ascii: /
2024-04-26 17:13:11 UTC	14842	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2024-04-26 17:13:11 UTC	16384	IN	Data Raw: 6c 6c 3b 61 3d 61 2e 65 78 74 72 61 63 74 6f 72 5f 63 6f 6e 66 69 67 3b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 78 74 2c 63 3d 61 2e 70 61 72 61 6d 65 74 65 72 5f 74 79 70 65 3b 61 3d 61 2e 76 61 6c 75 65 3b 62 3d 62 21 3d 6e 75 6c 6c 26 26 74 79 70 65 6f 66 20 62 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 62 21 3d 3d 22 22 3f 62 3a 6e 75 6c 6c 3b 63 3d 64 28 63 29 3b 61 3d 61 21 3d 6e 75 6c 6c 26 26 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 61 21 3d 3d 22 22 3f 61 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 21 3d Data Ascii: ll;a=a.extractor_config;if(a==null\|\|(typeof a==="undefined"?"undefined":i(a))!=="object")return null;var b=a.context,c=a.parameter_type;a=a.value;b=b!=null&&typeof b==="string"&&b!==""?b:null;c=d(c);a=a!=null&&typeof a==="string"&&a!==""?a:null;return b!=
2024-04-26 17:13:11 UTC	16384	IN	Data Raw: 50 41 52 41 4d 45 54 45 52 2c 78 3d 73 2e 72 65 61 64 50 61 63 6b 65 64 43 6f 6f 6b 69 65 2c 79 3d 73 2e 43 4c 49 43 4b 54 48 52 4f 55 47 48 5f 43 4f 4f 4b 49 45 5f 4e 41 4d 45 3b 73 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 70 65 72 69 6d 65 6e 74 4e 61 6d 65 73 22 29 3b 76 61 72 20 7a 3d 73 2e 55 53 45 5f 46 42 43 5f 41 53 5f 43 41 43 48 45 5f 4b 45 59 5f 45 58 50 45 52 49 4d 45 4e 54 2c 41 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 51 45 22 29 2c 42 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 Data Ascii: PARAMETER,x=s.readPackedCookie,y=s.CLICKTHROUGH_COOKIE_NAME;s=f.getFbeventsModules("SignalsFBEventsExperimentNames");var z=s.USE_FBC_AS_CACHE_KEY_EXPERIMENT,A=f.getFbeventsModules("SignalsFBEventsQE"),B=f.getFbeventsModules("SignalsFBEventsModuleEncodings
2024-04-26 17:13:11 UTC	16384	IN	Data Raw: 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 47 75 61 72 64 72 61 69 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 69 2c 6a 2c 6b 29 7b 76 61 72 20 6c 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6c 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 31 3b 62 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 62 2b 2b 29 7b 76 61 72 20 63 3d 61 72 67 75 6d 65 6e 74 73 5b 62 5d 3b 66 6f 72 28 76 61 72 20 64 20 69 6e 20 63 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 Data Ascii: Registered("SignalsFBEventsGuardrail",function(){return function(g,i,j,k){var l={exports:{}};l.exports;(function(){"use strict";var a=Object.assign\|\|function(a){for(var b=1;b<arguments.length;b++){var c=arguments[b];for(var d in c)Object.prototype.hasOwnP
2024-04-26 17:13:11 UTC	1541	IN	Data Raw: 73 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 61 72 72 61 79 4f 66 28 62 2e 73 74 72 69 6e 67 28 29 29 29 7d 29 29 2c 61 64 64 69 74 69 6f 6e 61 6c 55 73 65 72 44 61 74 61 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 6f 62 6a 65 63 74 57 69 74 68 46 69 65 6c 64 73 28 7b 73 65 6e 64 46 42 4c 6f 67 69 6e 49 44 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 5b 22 62 6f 6f 6c 65 61 6e 22 5d 28 29 29 7d 29 29 7d 29 3b 6b 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4f 70 74 49 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 Data Ascii: s:b.allowNull(b.arrayOf(b.string()))})),additionalUserData:b.allowNull(b.objectWithFields({sendFBLoginID:b.allowNull(b["boolean"]())}))});k.exports=a})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsOptIn",function(){return functi
2024-04-26 17:13:11 UTC	14843	IN	Data Raw: 6c 3f 63 28 64 28 62 29 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 62 5b 61 5d 3d 3d 3d 21 30 7d 29 3a 5b 5d 7d 7d 5d 29 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 6c 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6c 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 61 72 61 6c 6c 65 6c 46 69 72 65 43 6f 6e 66 69 67 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 Data Ascii: l?c(d(b),function(a){return b[a]===!0}):[]}}]);return a}();l.exports=a})();return l.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsParallelFireConfigTypedef",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use s
2024-04-26 17:13:11 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 29 29 72 65 74 75 72 6e 3b 66 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 62 2c 22 63 75 73 74 6f 6d 44 61 74 61 22 29 26 26 74 79 70 65 6f 66 20 62 2e 63 75 73 74 6f 6d 44 61 74 61 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 62 2e 63 75 73 74 6f 6d 44 61 74 61 21 3d 3d 6e 75 6c 6c 3b 66 7c 7c 28 62 2e 63 75 73 74 6f 6d 44 61 74 61 3d 7b 7d 29 3b 71 28 62 29 7d 6b 2e 65 78 70 6f 72 74 73 3d 72 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 45 76 Data Ascii: tion(a){return a}))return;f=Object.prototype.hasOwnProperty.call(b,"customData")&&typeof b.customData!=="undefined"&&b.customData!==null;f\|\|(b.customData={});q(b)}k.exports=r})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsSendEv
2024-04-26 17:13:11 UTC	16384	IN	Data Raw: 26 62 2e 70 75 73 68 28 73 5b 63 5d 29 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 76 28 61 2c 62 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 20 61 72 72 61 79 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 61 3d 4f 62 6a 65 63 74 28 61 29 3b 76 61 72 20 63 3d 61 2e 6c 65 6e 67 74 68 3e 3e 3e 30 3b 69 66 28 74 79 70 65 6f 66 20 62 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 62 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 76 61 72 20 64 3d 6e 65 77 20 41 72 72 61 79 28 63 29 2c 65 3d 30 3b 77 68 69 6c 65 28 65 3c 63 29 7b 76 61 72 20 66 3b 65 20 69 6e 20 61 26 26 28 66 3d 61 Data Ascii: &b.push(s[c]);return b}function v(a,b){if(a==null)throw new TypeError(" array is null or not defined");a=Object(a);var c=a.length>>>0;if(typeof b!=="function")throw new TypeError(b+" is not a function");var d=new Array(c),e=0;while(e<c){var f;e in a&&(f=a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49871	74.125.26.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:10 UTC	860	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1577951320&gjid=100817108&_gid=1323772131.1714151589&_u=YEBAAEAAAAAAACgEK~&z=339441304 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.xero.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	590	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.xero.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Fri, 26 Apr 2024 17:13:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:11 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49874	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	404	OUT	GET /ads/conversions-config/v1/pixel/config/t2_ewwvmnuh_telemetry HTTP/1.1 Host: www.redditstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	868	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86 access-control-allow-origin: * cache-control: max-age=300 content-type: application/json Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:11 GMT Via: 1.1 varnish Vary: Accept-Encoding,Origin Server: snooserv Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
2024-04-26 17:13:11 UTC	86	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 5f 68 61 73 68 22 3a 22 35 38 31 64 33 35 39 64 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 64 64 69 74 73 74 61 74 69 63 2e 63 6f 6d 2f 61 64 73 2f 35 38 31 64 33 35 39 64 2f 70 69 78 65 6c 2e 6a 73 22 7d Data Ascii: {"version_hash":"581d359d","url":"https://www.redditstatic.com/ads/581d359d/pixel.js"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49872	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	403	OUT	OPTIONS /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Origin: https://www.redditstatic.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	650	IN	HTTP/1.1 204 No Content Connection: close Server: Varnish Retry-After: 0 Access-Control-Allow-Origin: https://www.redditstatic.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:11 GMT Via: 1.1 varnish Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49875	68.180.135.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	515	OUT	GET /wi/ytc.js HTTP/1.1 Host: s.yimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	929	IN	HTTP/1.1 200 OK x-amz-id-2: u/eexR1QR/C/SVB0Q0WkRAOa8GWyLyTwkfX1b++cnaWc/ckaMpKpd7gpJANsing7E3N9dD9jyBy4OStSYkbJLWCBz3rjrImRbacGo8qOSwU= x-amz-request-id: GWBGEGTHPNRRBYQ5 Date: Fri, 26 Apr 2024 17:13:12 GMT Last-Modified: Mon, 26 Jun 2023 09:26:35 GMT x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle" ETag: "5c6ed25dce803fd84288922b8928409e" x-amz-server-side-encryption: AES256 Cache-Control: public,max-age=3600 x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW Accept-Ranges: bytes Content-Type: application/javascript Server: ATS Content-Length: 18187 Referrer-Policy: no-referrer-when-downgrade Vary: Origin Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 6e 2e 6d 3d 65 2c 6e 2e 63 3d 74 2c 6e 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 6e 2e 6f 28 65 2c 74 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 7d 29 7d 2c 6e 2e 72 3d 66 75 6e Data Ascii: !function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=fun
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 41 74 28 61 29 29 3e 3d 35 36 33 32 30 26 26 6f 3c 3d 35 37 33 34 33 29 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 33 39 2c 72 5b 6e 2b 3d 31 5d 3d 31 39 31 2c 72 5b 6e 2b 3d 31 5d 3d 31 38 39 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 61 2b 3d 31 2c 28 69 3d 31 30 32 34 2a 28 69 2d 35 35 32 39 36 29 2b 6f 2d 35 36 33 32 30 2b 36 35 35 33 36 29 3e 36 35 35 33 35 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 34 30 7c 69 3e 3e 3e 31 38 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 31 32 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 36 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 36 33 26 69 3b 63 6f 6e 74 69 6e 75 65 7d 7d 69 3c 3d 31 32 37 3f 72 5b 6e 2b 3d 31 5d 3d 30 7c 69 3a 69 3c 3d 32 30 34 37 3f 28 72 5b 6e 2b 3d 31 5d 3d 31 39 32 7c 69 3e 3e 3e 36 2c 72 Data Ascii: At(a))>=56320&&o<=57343)){r[n+=1]=239,r[n+=1]=191,r[n+=1]=189;continue}if(a+=1,(i=1024*(i-55296)+o-56320+65536)>65535){r[n+=1]=240\|i>>>18,r[n+=1]=128\|i>>>12&63,r[n+=1]=128\|i>>>6&63,r[n+=1]=128\|63&i;continue}}i<=127?r[n+=1]=0\|i:i<=2047?(r[n+=1]=192\|i>>>6,r
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 61 29 7b 69 66 28 21 74 28 61 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 72 72 61 79 2e 66 72 6f 6d 3a 20 77 68 65 6e 20 70 72 6f 76 69 64 65 64 2c 20 74 68 65 20 73 65 63 6f 6e 64 20 61 72 67 75 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 28 6f 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 66 6f 72 28 76 61 72 20 73 2c 75 3d 72 28 69 2e 6c 65 6e 67 74 68 29 2c 64 3d 74 28 6e 29 3f 4f 62 6a 65 63 74 28 6e 65 77 20 6e 28 75 29 29 3a 6e 65 77 20 41 72 72 61 79 28 75 29 2c 63 3d 30 3b 63 3c 75 3b 29 73 3d 69 5b 63 5d 2c 64 5b 63 5d 3d 61 3f 76 Data Ascii: arguments[1]:void 0;if(void 0!==a){if(!t(a))throw new TypeError("Array.from: when provided, the second argument must be a function");arguments.length>2&&(o=arguments[2])}for(var s,u=r(i.length),d=t(n)?Object(new n(u)):new Array(u),c=0;c<u;)s=i[c],d[c]=a?v
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 63 68 28 65 29 7b 7d 69 66 28 6e 3d 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 62 72 65 61 6b 3b 6e 3d 6e 2e 70 61 72 65 6e 74 7d 72 65 74 75 72 6e 20 74 7d 28 74 29 3b 69 66 28 21 69 29 72 65 74 75 72 6e 20 76 6f 69 64 20 76 28 65 29 3b 76 61 72 20 6f 3d 7b 7d 2c 61 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 22 22 3b 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 3d 3d 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 77 69 6e 64 6f 77 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 7b 5f 5f 74 63 66 61 70 69 43 61 6c 6c 3a 7b 63 6f 6d 6d 61 6e 64 3a 65 2c 70 61 72 61 6d 65 74 65 72 3a 61 2c 76 65 72 73 69 6f 6e 3a 69 2c 63 61 6c 6c 49 64 3a 72 7d 7d 3b 6e 5b 72 5d 3d 6f 2c 6c 28 74 2c 73 2c 22 2a 22 29 Data Ascii: ch(e){}if(n===window.top)break;n=n.parent}return t}(t);if(!i)return void v(e);var o={},a=Math.random()+"";"__tcfapiLocator"===t?function(e,t,n,r){window[e]=function(e,i,o,a){var s={__tcfapiCall:{command:e,parameter:a,version:i,callId:r}};n[r]=o,l(t,s,"*")
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 6e 67 3a 6e 2e 75 73 70 53 74 72 69 6e 67 2c 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 3a 6e 2e 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 7d 2c 21 30 29 3a 65 28 76 6f 69 64 20 30 2c 21 31 29 7d 29 29 29 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3b 6d 28 22 5f 5f 74 63 66 61 70 69 22 2c 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 2c 22 5f 5f 74 63 66 61 70 69 43 61 6c 6c 22 2c 22 5f 5f 74 63 66 61 70 69 52 65 74 75 72 6e 22 29 2c 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3f 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 3f 28 68 28 65 29 2c 76 28 22 5f 5f 74 63 66 61 70 69 22 29 29 3a 67 28 29 7d 2c 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 76 6f 69 64 20 30 2c 21 Data Ascii: ng:n.uspString,isOathFirstParty:n.isOathFirstParty},!0):e(void 0,!1)})))},y=function(){var e,t;m("__tcfapi","__tcfapiLocator","__tcfapiCall","__tcfapiReturn"),window.__tcfapi?(e=function(e,t){t?(h(e),v("__tcfapi")):g()},t=setTimeout((function(){e(void 0,!
2024-04-26 17:13:11 UTC	910	IN	Data Raw: 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 3a 22 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 2d 4a 61 6e 2d 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 4d 54 22 2c 6e 3d 65 2e 6e 61 6d 65 2b 22 3d 22 2b 65 2e 76 61 6c 75 65 2b 74 2b 22 3b 20 70 61 74 68 3d 22 2b 65 2e 70 61 74 68 2b 28 22 22 21 3d 3d 65 2e 64 6f 6d 61 69 6e 3f 22 3b 20 64 6f 6d 61 69 6e 3d 2e 22 2b 65 2e 64 6f 6d 61 69 6e 3a 22 22 29 2b 22 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 22 2c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 6e 7d 28 7b 6e 61 6d 65 3a 65 2c 76 61 6c 75 65 3a 74 2c 65 78 70 69 72 79 4f 66 66 73 65 74 3a 6e 2c 64 6f 6d 61 69 6e 3a 61 28 29 2c 70 61 74 68 3a 22 2f 22 7d 29 3b 76 61 72 20 72 3d 7b 69 64 3a 74 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 Data Ascii: .toGMTString():"; expires=Thu, 01-Jan-1970 00:00:01 GMT",n=e.name+"="+e.value+t+"; path="+e.path+(""!==e.domain?"; domain=."+e.domain:"")+"; SameSite=Lax",document.cookie=n}({name:e,value:t,expiryOffset:n,domain:a(),path:"/"});var r={id:t,timestamp:(new D
2024-04-26 17:13:11 UTC	852	IN	Data Raw: 3b 69 66 28 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3c 3d 6e 2e 74 69 6d 65 73 74 61 6d 70 2b 31 65 33 2a 74 29 72 65 74 75 72 6e 20 6e 2e 69 64 7d 7d 2c 6a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 28 65 2c 22 74 62 6c 63 69 22 2c 22 26 22 29 3b 74 3f 78 28 22 74 62 6c 63 69 22 2c 74 2c 76 6f 69 64 20 30 29 3a 54 28 29 7d 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 75 28 29 3b 69 66 28 65 29 7b 76 61 72 20 74 3d 65 2e 6d 61 74 63 68 28 6e 65 77 20 52 65 67 45 78 70 28 22 23 74 62 6c 63 69 28 5b 5e 23 26 5d 2a 29 22 29 29 3b 69 66 28 74 29 7b 76 61 72 20 6e 3d 74 5b 31 5d 3b 6e 26 26 78 28 22 74 62 6c 63 69 22 2c 6e 2c 76 6f 69 64 20 30 29 7d 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 43 28 65 29 7b 76 61 72 Data Ascii: ;if((new Date).getTime()<=n.timestamp+1e3t)return n.id}},j=function(e){var t=S(e,"tblci","&");t?x("tblci",t,void 0):T()},T=function(){var e=u();if(e){var t=e.match(new RegExp("#tblci([^#&])"));if(t){var n=t[1];n&&x("tblci",n,void 0)}}};function C(e){var
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 63 6f 64 65 72 29 2e 65 6e 63 6f 64 65 28 65 29 3b 72 65 74 75 72 6e 28 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 7c 7c 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2e 73 75 62 74 6c 65 2e 64 69 67 65 73 74 28 22 53 48 41 2d 32 35 36 22 2c 74 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 4c 28 65 29 7b 76 61 72 20 74 3d 65 2e 68 70 68 3b 69 66 28 74 29 7b 76 61 72 20 6e 3d 74 2e 74 72 69 6d 28 29 3b 49 65 28 6e 29 3f 67 65 2e 68 61 73 68 65 64 50 68 6f 6e 65 73 5b 65 2e 70 69 78 65 6c 49 64 5d 3d 6e 3a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 2f 5e 5b 30 2d 39 5f 2b 5c 2d 28 29 20 5d 2b 24 2f 2e 74 65 73 74 28 65 29 7d 28 6e 29 3f 64 65 6c 65 74 65 20 65 2e 68 70 68 3a 67 65 2e 70 6c 61 69 6e 50 68 6f 6e 65 73 5b 65 2e 70 69 78 65 6c 49 64 5d 3d 66 Data Ascii: coder).encode(e);return(window.crypto\|\|window.msCrypto).subtle.digest("SHA-256",t)};function L(e){var t=e.hph;if(t){var n=t.trim();Ie(n)?ge.hashedPhones[e.pixelId]=n:!function(e){return/^[0-9_+\-() ]+$/.test(e)}(n)?delete e.hph:ge.plainPhones[e.pixelId]=f
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 30 21 3d 3d 56 26 26 21 30 3d 3d 3d 56 2e 75 73 65 31 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 73 7c 7c 28 56 3d 65 29 7d 63 61 74 63 68 28 65 29 7b 7d 71 2d 2d 2c 79 65 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4a 28 65 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 68 65 26 26 28 65 2e 75 73 65 72 45 6d 61 69 6c 3d 65 2e 68 65 2c 64 65 6c 65 74 65 20 65 2e 68 65 29 7d 28 65 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 75 73 65 72 45 6d 61 69 6c 2c 6e 3d 65 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 3b 69 66 28 21 42 28 74 29 26 26 6e 29 7b 76 61 72 20 72 3d 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 74 72 69 6d 28 29 3b 42 28 72 29 26 26 28 65 2e 75 73 65 72 45 6d 61 69 6c 3d 72 2c 64 65 6c 65 74 65 20 65 2e 75 73 65 72 48 Data Ascii: 0!==V&&!0===V.use1stPartyCookies\|\|(V=e)}catch(e){}q--,ye()}}function J(e){!function(e){e.he&&(e.userEmail=e.he,delete e.he)}(e),function(e){var t=e.userEmail,n=e.userHashedEmail;if(!B(t)&&n){var r=n.toLowerCase().trim();B(r)&&(e.userEmail=r,delete e.userH
2024-04-26 17:13:11 UTC	1300	IN	Data Raw: 77 2e 54 65 78 74 45 6e 63 6f 64 65 72 29 2e 65 6e 63 6f 64 65 28 65 29 3b 72 65 74 75 72 6e 28 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 7c 7c 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2e 73 75 62 74 6c 65 2e 64 69 67 65 73 74 28 22 53 48 41 2d 32 35 36 22 2c 74 29 7d 3b 76 61 72 20 4b 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 51 28 65 2c 74 2c 6e 29 7b 74 65 28 65 29 5b 74 5d 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 65 65 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 2e 70 72 6f 6a 65 63 74 49 64 29 66 6f 72 28 6e 3d 30 2c 72 3d 28 74 3d 5b 22 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 22 2c 22 75 72 6c 22 2c 22 72 65 66 65 72 72 65 72 22 5d 29 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 3d 31 29 74 72 79 7b 51 28 65 2e 70 72 6f 6a Data Ascii: w.TextEncoder).encode(e);return(window.crypto\|\|window.msCrypto).subtle.digest("SHA-256",t)};var K={};function Q(e,t,n){te(e)[t]=n}function ee(e){var t,n,r;if(void 0!==e.projectId)for(n=0,r=(t=["documentName","url","referrer"]).length;n<r;n+=1)try{Q(e.proj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49873	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	528	OUT	GET /events.js HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	1700	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:11 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=5 Set-Cookie: sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTf2HR5.kTG6ERdJE3347H2HBP%2FyLJhmJDz7Lryn6HRSHmQl3e4; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTf2HR5.kTG6ERdJE3347H2HBP%2FyLJhmJDz7Lryn6HRSHmQl3e4; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None
2024-04-26 17:13:11 UTC	2410	IN	Data Raw: 39 36 33 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 77 29 20 7b 0a 20 20 2f 2f 20 42 65 67 69 6e 20 64 6f 63 0a 0a 20 20 76 61 72 20 69 73 5f 64 65 76 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 66 61 6c 73 65 20 29 20 7b 0a 20 20 20 20 69 73 5f 64 65 76 20 3d 20 74 72 75 65 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 74 72 75 65 20 29 20 7b 0a 20 20 20 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 74 72 75 65 0a 20 20 7d 0a 0a 20 20 76 61 72 20 74 69 70 20 3d 20 22 33 34 32 4b 6a 72 65 39 77 58 64 61 75 39 6c 78 76 6f 44 51 50 43 6c 7a 48 72 45 2d 61 43 61 34 54 4e 48 69 39 4c 38 37 46 58 73 22 0a 20 20 0a 20 20 76 61 72 20 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 Data Ascii: 963(function (w) { // Begin doc var is_dev = false; if ( false ) { is_dev = true; } var disable_sync = false; if ( true ) { disable_sync = true } var tip = "342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs" var userIdCookieV
2024-04-26 17:13:11 UTC	15595	IN	Data Raw: 33 63 65 33 0d 0a 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 72 65 66 5f 61 72 72 5b 31 5d 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 29 7d 63 61 74 63 68 28 65 29 7b 7d 76 61 72 20 65 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 61 6e 63 65 73 74 6f 72 4f 72 69 67 69 6e 73 3b 69 66 28 65 26 26 65 2e 6c 65 6e 67 74 68 3e 31 29 7b 76 61 72 20 6f 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3b 69 66 28 6f 29 72 65 74 75 72 6e 20 6f 7d 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 73 65 6c 66 21 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 26 26 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 3f 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 3a 65 26 26 65 5b 30 5d 3f 65 5b 30 5d 3a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 Data Ascii: 3ce3eURIComponent(oref_arr[1].split(";")[0])}catch(e){}var e=window.location.ancestorOrigins;if(e&&e.length>1){var o=e[e.length-1];if(o)return o}return window.self!==window.top&&window.document.referrer?window.document.referrer:e&&e[0]?e[0]:window.locat
2024-04-26 17:13:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49877	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	340	OUT	POST /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Content-Length: 466 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	466	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 34 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 32 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 35 31 2e 31 30 31 2e 31 39 33 2e 31 34 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f Data Ascii: [{"age":0,"body":{"elapsed_time":542,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://www.xero.com/","sampling_fraction":0.02,"server_ip":"151.101.193.140","status_code":200,"type":"ok"},"type":"network-error","url":"https://
2024-04-26 17:13:11 UTC	681	IN	HTTP/1.1 200 OK Connection: close Content-Length: 0 content-type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:11 GMT Via: 1.1 varnish Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block server: snooserv Access-Control-Allow-Origin: https://www.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49879	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	527	OUT	GET /up_loader.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 10159 Connection: close Date: Thu, 25 Apr 2024 19:52:55 GMT Last-Modified: Thu, 25 Apr 2024 19:49:47 GMT ETag: "d6f0435164aefe6cf324147b77c7b6bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5888333a47f4bcb4270f45fea45f08bc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: teuUhJkng8OREGS5ydn9lsBCOYjCXHg_zCWKgag9wyebwW1mdmI7YA== Age: 76817
2024-04-26 17:13:11 UTC	10159	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6c 65 74 20 63 3d 6e 75 6c 6c 3b 63 6f 6e 73 74 20 6c 3d 5b 22 64 65 62 75 67 22 2c 22 69 6e 66 6f 22 2c 22 77 61 72 6e 22 2c 22 65 72 72 6f 72 22 5d 3b 6c 65 74 20 61 3d 6c 2e 72 65 64 75 63 65 28 28 65 2c 64 2c 61 29 3d 3e 28 65 5b 64 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 22 64 65 62 75 67 22 3d 3d 3d 64 3f 22 6c 6f 67 22 3a 64 3b 69 66 28 63 26 26 63 6f 6e 73 6f 6c 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 5b 65 5d 29 7b 76 61 72 20 74 3d 6c 2e 69 6e 64 65 78 4f 66 28 63 2e 74 6f 53 74 72 69 6e 67 28 29 2e 74 6f 4c 6f 63 61 6c 65 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 69 66 28 21 30 3d 3d 3d 63 7c 7c 2d 31 3c 74 26 Data Ascii: !function(){"use strict";let c=null;const l=["debug","info","warn","error"];let a=l.reduce((e,d,a)=>(e[d]=function(){var e="debug"===d?"log":d;if(c&&console&&"function"==typeof console[e]){var t=l.indexOf(c.toString().toLocaleLowerCase());if(!0===c\|\|-1<t&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49880	13.249.98.101	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	537	OUT	GET /4cdf254ff02939a3.min.js HTTP/1.1 Host: tag.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	849	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 78687 Connection: close Date: Fri, 26 Apr 2024 17:13:12 GMT Last-Modified: Tue, 16 Apr 2024 11:25:11 GMT ETag: "9ba23104805b0ecdd9eca87fa3a3467a" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=3600 x-amz-version-id: Dfgdz9RHrD88uP3ZkWqD22YXdwL1Nc77 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 6a3e7ad00af2a0668fcdf5030d61e424.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: x-WiJR1aGc4MSuoTUP4wn0Pe1uZlqhQEEGIEYlMspr4i3aTKHQHiIA== Strict-Transport-Security: max-age=63072000; includeSubDomains; preload permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
2024-04-26 17:13:12 UTC	16384	IN	Data Raw: 76 61 72 20 44 65 6d 61 6e 64 62 61 73 65 3d 77 69 6e 64 6f 77 2e 44 65 6d 61 6e 64 62 61 73 65 7c 7c 7b 7d 3b 21 66 75 6e 63 74 69 6f 6e 28 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 4d 2c 78 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 73 70 72 65 61 64 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 69 66 28 69 7c 7c 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 6e 2c 6f 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 72 3b 6f 2b 2b 29 21 6e 26 26 6f 20 69 6e 20 65 7c 7c 28 28 6e 3d 6e 7c 7c 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 65 2c 30 2c 6f 29 29 5b 6f 5d 3d 65 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 74 2e 63 6f 6e 63 61 74 28 6e 7c 7c Data Ascii: var Demandbase=window.Demandbase\|\|{};!function(g){"use strict";var M,x=this&&this.__spreadArray\|\|function(t,e,i){if(i\|\|2===arguments.length)for(var n,o=0,r=e.length;o<r;o++)!n&&o in e\|\|((n=n\|\|Array.prototype.slice.call(e,0,o))[o]=e[o]);return t.concat(n\|\|
2024-04-26 17:13:12 UTC	511	IN	Data Raw: 5b 22 6e 61 6d 65 22 2c 22 73 65 67 6d 65 6e 74 73 22 2c 22 70 61 67 65 73 22 2c 22 6d 6f 64 69 66 79 22 5d 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 2e 6d 6f 64 69 66 79 29 72 65 74 75 72 6e 20 50 2e 55 74 69 6c 69 74 69 65 73 2e 4c 6f 67 67 69 6e 67 2e 6c 6f 67 28 22 44 42 43 6f 6e 74 65 6e 74 42 75 69 6c 64 65 72 3a 20 69 6e 76 61 6c 69 64 20 74 79 70 65 20 69 6e 20 63 6f 6e 66 69 67 2e 22 29 2c 21 31 3b 66 6f 72 28 76 61 72 20 69 3d 30 3b 69 3c 65 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 69 66 28 76 6f 69 64 20 30 3d 3d 3d 74 5b 65 5b 69 5d 5d 29 72 65 74 75 72 6e 20 50 2e 55 74 69 6c 69 74 69 65 73 2e 4c 6f 67 67 69 6e 67 2e 6c 6f 67 28 22 44 42 43 6f 6e 74 65 6e 74 42 75 69 6c 64 65 72 3a 20 69 6e 76 61 6c 69 64 20 63 6f 6e Data Ascii: ["name","segments","pages","modify"];if("function"!=typeof t.modify)return P.Utilities.Logging.log("DBContentBuilder: invalid type in config."),!1;for(var i=0;i<e.length;i++)if(void 0===t[e[i]])return P.Utilities.Logging.log("DBContentBuilder: invalid con
2024-04-26 17:13:12 UTC	12792	IN	Data Raw: 74 69 65 73 7c 7c 28 4c 2e 55 74 69 6c 69 74 69 65 73 3d 7b 7d 29 3b 28 45 3d 45 2e 45 76 65 6e 74 73 7c 7c 28 45 2e 45 76 65 6e 74 73 3d 7b 7d 29 29 2e 61 64 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 21 30 3b 69 66 28 21 6e 74 28 74 29 29 72 65 74 75 72 6e 20 4c 2e 55 74 69 6c 69 74 69 65 73 2e 4c 6f 67 67 69 6e 67 2e 6c 6f 67 28 22 45 76 65 6e 74 20 6e 6f 74 20 61 64 64 65 64 2e 22 29 2c 21 31 3b 76 61 72 20 69 2c 6e 3d 74 2e 74 79 70 65 7c 7c 4c 2e 55 74 69 6c 69 74 69 65 73 2e 43 6f 6e 73 74 61 6e 74 73 2e 44 46 4c 54 5f 45 56 45 4e 54 5f 54 59 50 45 2c 6f 3d 74 2e 65 6c 65 6d 65 6e 74 73 2c 72 3d 6f 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 69 66 28 72 21 3d 3d 48 54 4d 4c 43 6f 6c 6c 65 63 74 69 6f 6e 26 26 72 21 3d 3d 4e 6f 64 65 4c Data Ascii: ties\|\|(L.Utilities={});(E=E.Events\|\|(E.Events={})).add=function(t){var e=!0;if(!nt(t))return L.Utilities.Logging.log("Event not added."),!1;var i,n=t.type\|\|L.Utilities.Constants.DFLT_EVENT_TYPE,o=t.elements,r=o.constructor;if(r!==HTMLCollection&&r!==NodeL
2024-04-26 17:13:12 UTC	16384	IN	Data Raw: 7c 7c 74 68 69 73 3b 65 2e 44 45 46 41 55 4c 54 5f 43 4f 4e 46 49 47 55 52 41 54 49 4f 4e 3d 7b 65 6e 61 62 6c 65 64 3a 21 30 2c 61 73 73 65 74 4c 69 73 74 3a 5b 22 61 70 69 2e 64 65 6d 61 6e 64 62 61 73 65 2e 63 6f 6d 2f 61 75 74 6f 63 6f 6d 70 6c 65 74 65 2f 77 69 64 67 65 74 2e 6a 73 22 2c 22 61 70 69 2e 64 65 6d 61 6e 64 62 61 73 65 2e 63 6f 6d 2f 61 75 74 6f 63 6f 6d 70 6c 65 74 65 2f 77 69 64 67 65 74 2e 6d 69 6e 2e 6a 73 22 2c 22 61 75 74 6f 63 6f 6d 70 6c 65 74 65 2e 64 65 6d 61 6e 64 62 61 73 65 2e 63 6f 6d 2f 61 75 74 6f 63 6f 6d 70 6c 65 74 65 2f 77 69 64 67 65 74 2e 6a 73 22 2c 22 61 75 74 6f 63 6f 6d 70 6c 65 74 65 2e 64 65 6d 61 6e 64 62 61 73 65 2e 63 6f 6d 2f 61 75 74 6f 63 6f 6d 70 6c 65 74 65 2f 77 69 64 67 65 74 2e 6d 69 6e 2e 6a 73 22 Data Ascii: \|\|this;e.DEFAULT_CONFIGURATION={enabled:!0,assetList:["api.demandbase.com/autocomplete/widget.js","api.demandbase.com/autocomplete/widget.min.js","autocomplete.demandbase.com/autocomplete/widget.js","autocomplete.demandbase.com/autocomplete/widget.min.js"
2024-04-26 17:13:12 UTC	2804	IN	Data Raw: 29 2e 63 6f 6e 63 61 74 28 65 2c 22 20 76 61 6c 75 65 3d 22 29 2e 63 6f 6e 63 61 74 28 69 29 29 3b 77 69 6e 64 6f 77 2e 5f 67 61 71 2e 70 75 73 68 28 5b 6e 2c 74 3e 3e 30 2c 65 2c 69 2c 6f 5d 29 7d 3b 74 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 45 76 65 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 3b 69 66 28 74 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 74 29 69 66 28 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 29 7b 65 3d 74 5b 65 5d 3b 69 66 28 65 2e 64 61 74 61 29 7b 76 61 72 20 69 3d 65 2e 64 61 74 61 2e 63 61 74 65 67 6f 72 79 7c 7c 22 22 2c 6e 3d 65 2e 64 61 74 61 2e 61 63 74 69 6f 6e 7c 7c 22 22 2c 6f 3d 65 2e 64 61 74 61 2e 6c Data Ascii: ).concat(e," value=").concat(i));window._gaq.push([n,t>>0,e,i,o])};t.prototype._setEvents=function(){var t=this.configuration.events\|\|[];if(t)for(var e in t)if(t.hasOwnProperty(e)){e=t[e];if(e.data){var i=e.data.category\|\|"",n=e.data.action\|\|"",o=e.data.l
2024-04-26 17:13:12 UTC	2836	IN	Data Raw: 54 61 67 4d 61 6e 61 67 65 72 4d 6f 64 75 6c 65 3d 45 3b 79 3d 67 3d 67 7c 7c 7b 7d 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 69 29 7b 6e 28 74 2c 69 29 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 76 61 72 20 65 3d 69 2e 63 61 6c 6c 28 74 68 69 73 29 7c 7c 74 68 69 73 3b 65 2e 54 45 53 54 5f 4d 4f 44 45 5f 45 4e 41 42 4c 45 44 3d 22 64 62 5f 75 73 65 54 65 73 74 49 70 22 3b 65 2e 54 45 53 54 5f 4d 4f 44 45 5f 56 41 4c 55 45 3d 22 64 62 5f 69 70 22 3b 65 2e 41 50 49 5f 56 45 52 53 49 4f 4e 3d 22 76 32 22 3d 3d 3d 79 2e 55 74 69 6c 69 74 69 65 73 2e 64 69 67 28 79 2c 22 43 6f 6e 66 69 67 22 2c 22 67 65 6e 65 72 61 6c 22 2c 22 41 50 49 56 65 72 73 69 6f 6e 22 29 3f 22 76 32 22 3a 22 76 33 22 3b 65 2e 41 50 49 5f 45 4e 44 50 4f 49 4e 54 3d 22 61 70 69 2e 63 6f 6d Data Ascii: TagManagerModule=E;y=g=g\|\|{},t=function(i){n(t,i);function t(t){var e=i.call(this)\|\|this;e.TEST_MODE_ENABLED="db_useTestIp";e.TEST_MODE_VALUE="db_ip";e.API_VERSION="v2"===y.Utilities.dig(y,"Config","general","APIVersion")?"v2":"v3";e.API_ENDPOINT="api.com
2024-04-26 17:13:12 UTC	16384	IN	Data Raw: 65 74 75 72 6e 5b 32 2c 79 2e 55 74 69 6c 69 74 69 65 73 2e 4c 6f 67 67 69 6e 67 2e 6c 6f 67 28 22 49 50 20 41 50 49 20 71 75 65 72 79 20 76 69 61 20 44 4f 4d 20 74 61 67 22 29 5d 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 5b 34 2c 74 68 69 73 2e 62 75 69 6c 64 49 50 41 50 49 50 61 72 61 6d 65 74 65 72 73 28 61 29 5d 3b 63 61 73 65 20 33 3a 69 3d 74 2e 73 65 6e 74 28 29 3b 28 6e 3d 79 2e 55 74 69 6c 69 74 69 65 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 28 79 2e 55 74 69 6c 69 74 69 65 73 2e 43 6f 6e 73 74 61 6e 74 73 2e 51 53 5f 50 52 45 56 49 45 57 5f 54 4f 4b 45 4e 29 29 26 26 28 69 2e 70 72 65 76 69 65 77 5f 74 6f 6b 65 6e 3d 6e 29 3b 69 66 28 21 69 2e 6b 65 79 26 26 21 69 2e 61 75 74 68 29 72 65 74 75 72 6e 5b 32 2c 79 2e 55 74 69 6c 69 74 69 65 73 Data Ascii: eturn[2,y.Utilities.Logging.log("IP API query via DOM tag")];case 2:return[4,this.buildIPAPIParameters(a)];case 3:i=t.sent();(n=y.Utilities.getQueryParam(y.Utilities.Constants.QS_PREVIEW_TOKEN))&&(i.preview_token=n);if(!i.key&&!i.auth)return[2,y.Utilities
2024-04-26 17:13:12 UTC	10592	IN	Data Raw: 5b 69 5d 3b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 74 68 69 73 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 63 68 65 63 6b 56 61 6c 75 65 28 74 68 69 73 2e 76 61 6c 75 65 29 3b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 74 68 69 73 2e 76 61 6c 75 65 29 69 66 28 21 30 3d 3d 3d 74 68 69 73 2e 5f 63 68 65 63 6b 56 61 6c 75 65 28 74 68 69 73 2e 76 61 6c 75 65 5b 74 5d 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 7d 3b 77 69 6e 64 6f 77 2e 44 65 6d 61 6e 64 62 61 73 65 2e 44 42 43 6f 6e 64 69 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 6e 61 6d 65 3d 22 44 42 43 6f 6e 64 69 74 69 6f 6e 22 3b 77 69 6e 64 6f 77 2e 44 65 6d 61 6e 64 62 61 73 65 2e 44 42 43 6f 6e 64 69 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 73 Data Ascii: [i];if("object"!=typeof this.value)return this._checkValue(this.value);for(var t in this.value)if(!0===this._checkValue(this.value[t]))return!0;return!1}};window.Demandbase.DBCondition.prototype.name="DBCondition";window.Demandbase.DBCondition.prototype.s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49876	192.184.68.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	525	OUT	GET /quant.js HTTP/1.1 Host: secure.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:11 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:11 GMT Content-Type: application/javascript Content-Length: 23678 Connection: close Accept-Ranges: bytes Cache-Control: private, max-age=604800 Etag: "bvEECQq4Zy6gU9J/qv1O6Q==" Expires: Fri, 03 May 2024 17:13:11 GMT Vary: Accept-Encoding
2024-04-26 17:13:11 UTC	16089	IN	Data Raw: 2f 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 38 2d 32 30 32 33 2c 20 51 75 61 6e 74 63 61 73 74 20 43 6f 72 70 2e 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 71 75 61 6e 74 63 61 73 74 2e 63 6f 6d 2f 6c 65 67 61 6c 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 22 71 63 53 65 73 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 72 28 29 3b 72 65 74 75 72 6e 22 78 78 78 78 78 78 78 78 2d 78 78 78 78 2d 34 78 78 78 2d 79 78 78 78 2d 78 78 78 78 78 78 78 78 78 78 78 78 22 2e 72 65 70 6c 61 63 65 28 2f 5b 78 79 5d 2f 67 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 28 65 2b 31 36 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 25 31 36 7c 30 3b Data Ascii: /* Copyright (c) 2008-2023, Quantcast Corp. https://www.quantcast.com/legal/license /!function(){"use strict";var e="qcSes";function t(){var e=r();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(function(t){var n=(e+16Math.random())%16\|0;
2024-04-26 17:13:12 UTC	7589	IN	Data Raw: 5b 65 5d 26 26 28 74 3d 54 65 5b 65 5d 2c 6e 2e 70 75 73 68 28 74 29 2c 64 65 6c 65 74 65 20 54 65 5b 65 5d 29 3b 69 66 28 31 3d 3d 6e 2e 6c 65 6e 67 74 68 26 26 79 28 6e 5b 30 5d 29 2c 6e 2e 6c 65 6e 67 74 68 3e 31 29 66 6f 72 28 65 3d 30 3b 65 3c 6e 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 79 28 6e 5b 65 5d 29 7d 7d 2c 72 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 72 3d 5b 5d 3b 66 6f 72 28 6e 3d 6a 65 2e 73 6c 69 63 65 28 30 29 2c 65 3d 30 3b 65 3c 6e 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 3d 6e 5b 65 5d 2c 59 28 74 29 7c 7c 72 2e 70 75 73 68 28 74 29 3b 69 66 28 30 3d 3d 3d 72 2e 6c 65 6e 67 74 68 29 6e 65 28 29 3b 65 6c 73 65 20 66 6f 72 28 65 3d 30 3b 65 3c 72 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 3d 72 5b 65 5d 2c 43 65 2e 70 Data Ascii: [e]&&(t=Te[e],n.push(t),delete Te[e]);if(1==n.length&&y(n[0]),n.length>1)for(e=0;e<n.length;e++)y(n[e])}},re=function(){var e,t,n,r=[];for(n=je.slice(0),e=0;e<n.length;e++)t=n[e],Y(t)\|\|r.push(t);if(0===r.length)ne();else for(e=0;e<r.length;e++)t=r[e],Ce.p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49881	173.194.216.155	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	616	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1577951320&gjid=100817108&_gid=1323772131.1714151589&_u=YEBAAEAAAAAAACgEK~&z=339441304 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Fri, 26 Apr 2024 17:13:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:12 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49886	68.180.135.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	555	OUT	GET /wi/config/10175613.json HTTP/1.1 Host: s.yimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	768	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method x-amz-request-id: K5WGRAR6KVZ52C2E x-amz-id-2: 2fyO8GAb7xXfaioAbENKiwrY98ssIqF8rm+dlvBM2MSifZ4XNWXCkAuo0xntNw2thDpcNCSZVUc= Content-Type: application/json Date: Fri, 26 Apr 2024 16:16:15 GMT Server: ATS Referrer-Policy: no-referrer-when-downgrade Cache-Control: public,max-age=3600 Content-Length: 2 Age: 3417 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff ATS-Carp-Promotion: 1
2024-04-26 17:13:12 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49884	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	1231	OUT	GET /sa.css HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:12 UTC	222	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:12 GMT Content-Type: text/css Content-Length: 65 Connection: close Access-Control-Allow-Origin: * Cache-Control: only-if-cached, no-transform, private, max-age=7776000
2024-04-26 17:13:12 UTC	65	IN	Data Raw: 3a 72 6f 6f 74 20 7b 0a 20 20 20 20 2d 2d 73 61 2d 75 69 64 3a 20 27 30 2d 30 64 35 64 34 64 30 30 2d 38 65 64 30 2d 35 62 63 33 2d 34 32 62 31 2d 37 30 33 61 62 32 66 39 34 37 35 37 27 3b 0a 7d Data Ascii: :root { --sa-uid: '0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757';}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49885	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:11 UTC	552	OUT	GET /sa.jpeg HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	1308	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:12 GMT Content-Type: image/jpeg Content-Length: 651 Connection: close Access-Control-Allow-Origin: * Cache-Control: only-if-cached, no-transform, private, max-age=7776000 Set-Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCowa-xBjABOgT87-jmQgT5HPXm.7d1uKPe5wPMHmdBPFnz%2FbAxLmNSwA61GdHqHabW9i3k; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCowa-xBjABOgT87-jmQgT5HPXm.7d1uKPe5wPMHmdBPFnz%2FbAxLmNSwA61GdHqHabW9i3k; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None
2024-04-26 17:13:12 UTC	651	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 01 00 01 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49890	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	1420	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	1394	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49891	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	1384	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	1358	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49893	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	1968	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs&host=https%3A%2F%2Fwww.xero.com&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:12 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:13:12 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49892	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	1968	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs&host=https%3A%2F%2Fwww.xero.com&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:12 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:13:12 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49895	68.180.135.251	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	357	OUT	GET /wi/config/10175613.json HTTP/1.1 Host: s.yimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	610	IN	HTTP/1.1 200 OK x-amz-request-id: HE4N5A3R179VKQFC x-amz-id-2: wmbZmxO3VJKQsdMPNOBvnHZrJz+srWPxIUBlD9qEUK8B9/nYaHnlvQIZgWZIFNFLSGRi4nhtsdjH5QuSSFFvIA== Content-Type: application/json Date: Fri, 26 Apr 2024 17:13:12 GMT Server: ATS Referrer-Policy: no-referrer-when-downgrade Vary: Origin Cache-Control: public,max-age=3600 Age: 0 Transfer-Encoding: chunked Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2024-04-26 17:13:12 UTC	12	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2{}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49897	151.101.65.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	910	OUT	GET /rp.gif?ts=1714151589122&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:12 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49899	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	884	OUT	POST /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&page_title=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive Content-Length: 63 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:12 UTC	63	OUT	Data Raw: 7b 22 73 72 63 22 3a 22 74 61 67 22 2c 22 61 75 74 68 22 3a 22 42 47 43 53 44 6b 35 4c 45 48 4f 34 4d 50 56 70 67 44 52 4e 75 50 75 65 33 4d 4a 56 35 47 75 64 4d 31 70 30 45 49 42 6b 22 7d Data Ascii: {"src":"tag","auth":"BGCSDk5LEHO4MPVpgDRNuPue3MJV5GudM1p0EIBk"}
2024-04-26 17:13:13 UTC	951	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Content-Length: 3740 Connection: close Date: Fri, 26 Apr 2024 17:13:12 GMT Server: nginx Access-Control-Allow-Origin: https://www.xero.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: x-amz-cf-id Access-Control-Max-Age: 7200 Access-Control-Allow-Credentials: true Api-Version: v2 Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Identification-Source: CACHE Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 25 Apr 2024 17:13:12 GMT Vary: Accept-Encoding, Origin Request-ID: c06ab4e0-4e9a-4cf9-bd5b-794c34722a74 X-Cache: Miss from cloudfront Via: 1.1 c3fb36940fb36cf227975bfb7c09ea6c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: BeXTyI0MEJVnJIqjrGOxN9pPd9PDm3fIDZBHVF6kwmKsSs4xNg8MzQ==
2024-04-26 17:13:13 UTC	3740	IN	Data Raw: 7b 22 68 71 22 3a 7b 22 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 64 65 6d 61 6e 64 62 61 73 65 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 61 6c 69 61 73 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 69 6e 64 75 73 74 72 79 22 3a 22 42 75 73 69 6e 65 73 73 20 53 65 72 76 69 63 65 73 22 2c 22 73 75 62 5f 69 6e 64 75 73 74 72 79 22 3a 22 47 65 6e 65 72 61 6c 22 2c 22 65 6d 70 6c 6f 79 65 65 5f 63 6f 75 6e 74 22 3a 32 31 38 34 2c 22 70 72 69 6d 61 72 79 5f 73 69 63 22 3a 22 37 33 38 39 22 2c 22 70 72 69 6d 61 72 79 5f 6e 61 69 63 73 22 3a 6e 75 6c 6c 2c 22 73 74 72 65 65 74 5f 61 64 64 72 65 73 73 22 3a 22 35 39 35 20 53 20 38 30 20 45 20 53 74 65 20 33 30 30 22 2c 22 63 69 74 79 Data Ascii: {"hq":{"company_name":"Conservice","demandbase_sid":27340206,"marketing_alias":"Conservice","industry":"Business Services","sub_industry":"General","employee_count":2184,"primary_sic":"7389","primary_naics":null,"street_address":"595 S 80 E Ste 300","city

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49898	34.96.71.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	692	OUT	GET /s/sync?exc=lr HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	511	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET,OPTIONS Content-Type: text/html; charset=UTF-8 Set-Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1714151593\|ix:0\|mctv:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Fri, 26 Apr 2024 17:13:13 GMT Content-Length: 634 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:13 UTC	634	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 31 38 26 61 6d 70 3b 65 78 70 69 72 79 3d 31 37 32 39 39 36 32 37 39 33 26 61 6d 70 3b 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 37 63 33 30 35 61 64 62 2d 65 32 39 38 2d 34 32 64 31 2d 39 36 33 36 2d 34 33 37 35 64 30 61 32 36 39 32 63 22 20 61 6c 74 3d 22 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 2c 20 61 72 69 61 2d 68 Data Ascii: <html><head><title>Pixels</title></head><body><img src="https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1729962793&external_user_id=7c305adb-e298-42d1-9636-4375d0a2692c" alt="" width="0" height="0" style="display:none", aria-h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49896	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:12 UTC	1046	OUT	GET /sa.jpeg HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:13 UTC	225	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:12 GMT Content-Type: image/jpeg Content-Length: 651 Connection: close Access-Control-Allow-Origin: * Cache-Control: only-if-cached, no-transform, private, max-age=7776000
2024-04-26 17:13:13 UTC	651	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 01 00 01 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49900	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	1494	OUT	GET /activityi;dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-04-26 17:13:13 UTC	984	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:13 GMT Expires: Fri, 26 Apr 2024 17:13:13 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUnPmQ5seOR2uRDwcnk0T9SrIFiDlcGJ6vkrx05ku0NV3maXg4yI04F71uisdzI; expires=Sun, 26-Apr-2026 17:13:13 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:13:13 UTC	271	IN	Data Raw: 33 37 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4f 53 65 6b 36 61 77 34 49 55 44 46 58 Data Ascii: 376<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COSek6aw4IUDFX
2024-04-26 17:13:13 UTC	622	IN	Data Raw: 3d 39 34 30 31 33 32 30 3b 74 79 70 65 3d 70 61 67 65 76 30 3b 63 61 74 3d 67 6c 6f 62 61 30 30 30 3b 6f 72 64 3d 31 3b 6e 75 6d 3d 39 30 31 37 35 37 39 36 38 38 33 30 33 3b 6e 70 61 3d 30 3b 61 75 69 64 64 63 3d 2a 3b 75 31 3d 25 32 46 75 73 25 32 46 74 72 79 2d 6e 6f 77 25 32 46 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 25 32 46 3b 75 37 3d 66 75 6e 63 74 69 6f 6e 28 61 29 25 37 42 61 2e 73 65 74 28 25 32 32 64 69 6d 65 6e 73 69 6f 6e 25 32 32 25 32 42 62 25 32 43 61 2e 67 65 74 28 25 32 32 63 6c 69 65 6e 74 49 64 25 32 32 29 29 25 37 44 3b 70 73 3d 31 3b 70 63 6f 72 3d 31 31 31 34 38 36 35 34 38 38 3b 75 61 61 3d 78 38 36 3b 75 61 62 3d 36 34 3b 75 61 66 76 6c 3d 47 6f 6f 67 6c 65 25 32 35 32 30 43 68 72 6f 6d 65 25 33 42 31 31 37 2e 30 2e 35 39 33 Data Ascii: =9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.593
2024-04-26 17:13:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49902	157.240.14.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	1303	OUT	GET /signals/config/303901320544451?v=2.9.154&r=stable&domain=www.xero.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105 HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	1465	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2024-04-26 17:13:13 UTC	1524	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 2f 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 Data Ascii: /* Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wi
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 75 72 6e 21 30 7d 28 29 29 72 65 74 75 72 6e 3b 76 61 72 20 67 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 29 3d 3d 3d 22 73 79 6d 62 6f 6c 22 3f 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 7d 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 61 21 3d 3d 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 Data Ascii: urn!0}())return;var g=typeof Symbol==="function"&&typeof (typeof Symbol==="function"?Symbol.iterator:"@@iterator")==="symbol"?function(a){return typeof a}:function(a){return a&&typeof Symbol==="function"&&a.constructor===Symbol&&a!==(typeof Symbol==="func
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 61 2c 62 29 3a 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 61 2c 62 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 7c 7c 28 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 3d 7b 7d 2c 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 7b 7d 2c 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 3d Data Ascii: Object.setPrototypeOf?Object.setPrototypeOf(a,b):a.__proto__=b)}function l(a,b){if(!(a instanceof b))throw new TypeError("Cannot call a class as a function")}f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 61 2e 70 69 78 65 6c 3b 61 3d 61 2e 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3b 76 61 72 20 6b 3d 61 26 26 69 3d 3d 6e 75 6c 6c 3b 69 3d 63 28 7b 62 75 74 74 6f 6e 3a 65 2c 63 6f 6e 74 61 69 6e 65 72 45 6c 65 6d 65 6e 74 3a 6b 3f 68 3a 69 2c 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3a 61 7d 29 3b 61 3d 64 28 29 3b 76 61 72 20 6c 3d 69 2e 66 6f 72 6d 46 69 65 6c 64 46 65 61 74 75 72 65 73 3b 69 3d 69 2e 75 73 65 72 44 61 74 61 3b 66 3d 7b 62 75 74 74 6f 6e 46 65 61 74 75 72 65 73 3a 66 2c 62 75 74 74 6f 6e 54 65 78 74 3a 67 2c 66 6f 72 6d 46 65 61 74 75 72 65 73 3a 6b 3f 5b 5d 3a 6c 2c 70 61 67 65 46 65 61 74 75 72 65 73 3a 61 2c 70 61 72 61 6d 65 74 65 72 73 3a 62 2e 74 72 69 67 67 65 72 28 7b 70 69 78 65 6c 3a Data Ascii: a.pixel;a=a.shouldExtractUserData;var k=a&&i==null;i=c({button:e,containerElement:k?h:i,shouldExtractUserData:a});a=d();var l=i.formFieldFeatures;i=i.userData;f={buttonFeatures:f,buttonText:g,formFeatures:k?[]:l,pageFeatures:a,parameters:b.trigger({pixel:
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 61 28 29 2c 6b 3d 5b 5d 2c 6c 3d 7b 7d 3b 69 66 28 68 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 7b 66 6f 72 6d 46 69 65 6c 64 46 65 61 74 75 72 65 73 3a 6b 2c 75 73 65 72 44 61 74 61 3a 6c 7d 3b 68 3d 68 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 65 29 3b 66 6f 72 28 76 61 72 20 6d 3d 30 3b 6d 3c 68 2e 6c 65 6e 67 74 68 3b 6d 2b 2b 29 7b 76 61 72 20 6e 3d 68 5b 6d 5d 3b 69 66 28 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 49 6e 70 75 74 45 6c 65 6d 65 6e 74 7c 7c 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 54 65 78 74 41 72 65 61 45 6c 65 6d 65 6e 74 7c 7c 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 53 65 6c 65 63 74 45 6c 65 6d 65 6e 74 7c 7c 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 42 75 74 74 6f 6e 45 6c 65 6d 65 Data Ascii: a(),k=[],l={};if(h==null)return{formFieldFeatures:k,userData:l};h=h.querySelectorAll(e);for(var m=0;m<h.length;m++){var n=h[m];if(n instanceof HTMLInputElement\|\|n instanceof HTMLTextAreaElement\|\|n instanceof HTMLSelectElement\|\|n instanceof HTMLButtonEleme
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 6e 74 73 5b 62 5d 3b 66 6f 72 28 76 61 72 20 64 20 69 6e 20 63 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 63 2c 64 29 26 26 28 61 5b 64 5d 3d 63 5b 64 5d 29 7d 72 65 74 75 72 6e 20 61 7d 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 55 74 69 6c 73 22 29 2c 63 3d 62 2e 65 61 63 68 2c 64 3d 2f 5b 5e 5c 73 5c 22 5d 2f 2c 65 3d 2f 5b 5e 5c 73 3a 2b 5c 22 5d 2f 3b 66 75 6e 63 74 69 6f 6e 20 67 28 62 2c 63 2c 66 29 7b 69 66 28 66 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 64 2e 74 65 73 74 28 63 29 3f 63 3d 3d 3d 22 40 22 3f 6e 75 6c 6c 3a 7b 73 74 61 72 74 3a 62 2c 75 73 65 72 4f 72 44 6f 6d 61 69 6e 3a 22 75 73 65 72 Data Ascii: nts[b];for(var d in c)Object.prototype.hasOwnProperty.call(c,d)&&(a[d]=c[d])}return a},b=f.getFbeventsModules("SignalsFBEventsUtils"),c=b.each,d=/[^\s\"]/,e=/[^\s:+\"]/;function g(b,c,f){if(f==null)return d.test(c)?c==="@"?null:{start:b,userOrDomain:"user
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 2e 5f 72 61 74 65 4d 53 3d 63 7d 68 28 62 2c 5b 7b 6b 65 79 3a 22 5f 70 61 73 73 65 73 54 68 72 6f 74 74 6c 65 49 6d 70 6c 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 5f 6c 61 73 74 41 72 67 73 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 62 3d 44 61 74 65 2e 6e 6f 77 28 29 2c 63 3d 62 2d 74 68 69 73 2e 5f 6c 61 73 74 54 69 6d 65 3b 69 66 28 63 3e 3d 74 68 69 73 2e 5f 72 61 74 65 4d 53 29 72 65 74 75 72 6e 21 30 3b 66 6f 72 28 76 61 72 20 64 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 65 3d 41 72 72 61 79 28 64 29 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 65 5b 66 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 66 5d 3b 69 66 28 61 2e 6c 65 6e 67 74 68 21 3d 3d 65 2e 6c 65 6e 67 74 68 Data Ascii: ._rateMS=c}h(b,[{key:"_passesThrottleImpl",value:function(){var a=this._lastArgs;if(a==null)return!0;var b=Date.now(),c=b-this._lastTime;if(c>=this._rateMS)return!0;for(var d=arguments.length,e=Array(d),f=0;f<d;f++)e[f]=arguments[f];if(a.length!==e.length
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 74 72 61 63 74 46 72 6f 6d 49 6e 70 75 74 73 22 29 2c 42 3d 6e 65 77 20 74 28 29 2c 43 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 44 6f 41 75 74 6f 6d 61 74 69 63 4d 61 74 63 68 69 6e 67 22 29 2c 44 3d 31 30 30 3b 66 75 6e 63 74 69 6f 6e 20 45 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 62 2e 62 75 74 74 6f 6e 53 65 6c 65 63 74 6f 72 3d 3d 3d 22 65 78 74 65 6e 64 65 64 22 7d 66 75 6e 63 74 69 6f 6e 20 46 28 62 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 63 29 7b 69 66 28 62 2e 64 69 73 61 62 6c 65 41 75 74 6f 43 6f 6e 66 69 67 29 72 65 74 75 Data Ascii: .getFbeventsModules("signalsFBEventsExtractFromInputs"),B=new t(),C=f.getFbeventsModules("signalsFBEventsDoAutomaticMatching"),D=100;function E(a,b){return b!=null&&b.buttonSelector==="extended"}function F(b){return function(c){if(b.disableAutoConfig)retu
2024-04-26 17:13:13 UTC	1500	IN	Data Raw: 29 2c 63 29 2c 63 2e 65 78 74 72 61 63 74 50 49 49 3d 47 2c 65 29 2c 6a 28 63 2c 64 29 7d 72 65 74 75 72 6e 20 62 7d 28 62 29 3b 65 2e 65 78 70 6f 72 74 73 3d 6e 65 77 20 75 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 63 2e 6c 69 73 74 65 6e 4f 6e 63 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 77 28 46 28 62 29 29 3b 68 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 68 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 61 2c 7b 63 61 70 74 75 72 65 3a 21 30 2c 6f 6e 63 65 3a 21 31 2c 70 61 73 73 69 76 65 3a 21 30 7d 29 3a 67 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 63 6c 69 63 6b 22 2c 61 29 7d 29 2c 6d 2e 6c 69 73 74 65 6e 28 66 75 6e 63 74 69 6f 6e 28 61 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 47 28 Data Ascii: ),c),c.extractPII=G,e),j(c,d)}return b}(b);e.exports=new u(function(a,b){c.listenOnce(function(){var a=w(F(b));h.addEventListener?h.addEventListener("click",a,{capture:!0,once:!1,passive:!0}):g.attachEvent("onclick",a)}),m.listen(function(a,c,d){return G(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49901	151.101.65.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	910	OUT	GET /rp.gif?ts=1714151589124&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:13 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49903	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	1458	OUT	GET /activityi;dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-04-26 17:13:13 UTC	984	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:13 GMT Expires: Fri, 26 Apr 2024 17:13:13 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; expires=Sun, 26-Apr-2026 17:13:13 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:13:13 UTC	271	IN	Data Raw: 33 35 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4d 79 6a 6d 4b 61 77 34 49 55 44 46 65 Data Ascii: 352<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CMyjmKaw4IUDFe
2024-04-26 17:13:13 UTC	586	IN	Data Raw: 3d 39 34 30 31 33 32 30 3b 74 79 70 65 3d 70 61 67 65 76 30 3b 63 61 74 3d 67 6c 6f 62 61 30 30 32 3b 6f 72 64 3d 31 3b 6e 75 6d 3d 38 33 35 35 32 36 38 33 34 34 36 33 32 3b 6e 70 61 3d 30 3b 61 75 69 64 64 63 3d 2a 3b 75 31 3d 25 32 46 75 73 25 32 46 74 72 79 2d 6e 6f 77 25 32 46 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 25 32 46 3b 70 73 3d 31 3b 70 63 6f 72 3d 32 31 32 39 38 31 33 36 37 36 3b 75 61 61 3d 78 38 36 3b 75 61 62 3d 36 34 3b 75 61 66 76 6c 3d 47 6f 6f 67 6c 65 25 32 35 32 30 43 68 72 6f 6d 65 25 33 42 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 25 37 43 4e 6f 74 25 32 35 33 42 41 25 32 35 33 44 42 72 61 6e 64 25 33 42 38 2e 30 2e 30 2e 30 25 37 43 43 68 72 6f 6d 69 75 6d 25 33 42 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 3b 75 61 6d 62 3d Data Ascii: =9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=*;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=
2024-04-26 17:13:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49907	142.250.217.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	814	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1577951320&_u=YEBAAEAAAAAAACgEK~&z=1747383112 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49906	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	1770	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs&host=https%3A%2F%2Fwww.xero.com&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:13 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:13:13 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49905	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	1770	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=342Kjre9wXdau9lxvoDQPClzHrE-aCa4TNHi9L87FXs&host=https%3A%2F%2Fwww.xero.com&sa-user-id-v3=s%253AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%252FoKSM3ols6rF1dTaHaIKwOQ&sa-user-id-v2=s%253ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%252FXbMCg%252Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw&sa-user-id=s%253A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%252F90GVaXib7fKMYgzuHY HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:13 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:13:13 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49910	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	678	OUT	GET /rp.gif?ts=1714151589122&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:13 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49911	18.239.228.142	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	528	OUT	GET /aat/amzn.js HTTP/1.1 Host: c.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	668	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 13289 Connection: close Last-Modified: Mon, 15 Apr 2024 15:10:47 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: CqtBPlHFRJ4DVXdFOl0Nv05VUvH3bTHU Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 1bffd4a1b88ed4ab0d5da6a91c124fce.cloudfront.net (CloudFront), 1.1 cbe4325ad36a5e433aca98cb0212142c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 Date: Fri, 26 Apr 2024 17:13:13 GMT ETag: "3d13ef41aa477d7e1ec276886b9e0ec5" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: kjF6BVrvyOxf7QL3an--ZUkJVIGp9dpihZzfZM1szZUZWsE5_V6epg==
2024-04-26 17:13:13 UTC	13289	IN	Data Raw: 2f 2a 20 55 73 65 20 6f 66 20 74 68 69 73 20 70 69 78 65 6c 20 69 73 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 41 6d 61 7a 6f 6e 20 61 64 20 73 70 65 63 73 20 61 6e 64 20 70 6f 6c 69 63 69 65 73 20 61 74 20 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6d 61 7a 6f 6e 2e 63 6f 6d 2f 62 2f 3f 26 6e 6f 64 65 3d 37 32 35 33 30 31 35 30 31 31 2e 20 56 65 72 73 69 6f 6e 20 6e 75 6d 62 65 72 3a 20 36 2c 20 43 68 61 6e 67 65 73 65 74 3a 20 41 64 64 69 6e 67 20 69 6e 20 70 68 6f 6e 65 20 6e 75 6d 62 65 72 20 73 75 70 70 6f 72 74 20 66 6f 72 20 73 65 74 55 73 65 72 44 61 74 61 20 2a 2f 0a 74 68 69 73 2e 61 6d 7a 6e 3d 74 68 69 73 2e 61 6d 7a 6e 7c 7c 7b 7d 2c 74 68 69 73 2e 61 6d 7a 6e 2e 6a 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b Data Ascii: /* Use of this pixel is subject to the Amazon ad specs and policies at http://www.amazon.com/b/?&node=7253015011. Version number: 6, Changeset: Adding in phone number support for setUserData */this.amzn=this.amzn\|\|{},this.amzn.js=function(){"use strict";

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49914	13.32.87.20	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	635	OUT	GET /bg9s?x-amz-cf-id=BeXTyI0MEJVnJIqjrGOxN9pPd9PDm3fIDZBHVF6kwmKsSs4xNg8MzQ==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	578	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 f0d2db130f25377126d8fc517e82fa4c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: znmerG1BlTNVBFVHqZCtrzRb1nL4pBvj5XEvqX9QCBhX3O4qvwE0_Q== Age: 71130 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49915	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	625	OUT	GET /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&page_title=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	491	IN	HTTP/1.1 401 Unauthorized Content-Type: text/plain;charset=utf-8 Content-Length: 12 Connection: close Date: Fri, 26 Apr 2024 17:13:13 GMT Server: nginx WWW-Authenticate: DemandBase API v2 X-Content-Type-Options: nosniff Request-ID: 9aac6669-a9e6-4f34-a4a1-006caa15927f Vary: Origin X-Cache: Error from cloudfront Via: 1.1 fb086f315a09c6603ff2f1e41c8e76fa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: zSuzT88epkTOngtT2IitHkVqypWZt-fMwrKVB2oSp-WqwAX0T2gSPA==
2024-04-26 17:13:13 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49909	146.75.124.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	524	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	543	IN	HTTP/1.1 200 OK Connection: close Content-Length: 57671 Last-Modified: Thu, 04 Apr 2024 00:26:35 GMT ETag: "bbbcf811d8437a575d796a4c1e5d4fad" x-amz-server-side-encryption: AES256 Cache-Control: no-cache Content-Type: application/javascript; charset=utf-8 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:13 GMT X-Served-By: cache-iad-kcgs7200164-IAD, cache-mia-kmia1760026-MIA X-Cache: HIT, HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 36 31 37 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3b 74 2e 65 78 70 6f 72 74 73 3d 28 72 3d 72 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 26 26 28 72 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2e 63 72 79 70 74 6f 26 26 28 72 3d 73 65 6c 66 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 26 26 28 72 3d Data Ascii: !function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 68 69 73 2e 77 6f 72 64 73 3d 74 7c 7c 5b 5d 2c 74 68 69 73 2e 73 69 67 42 79 74 65 73 3d 6e 75 6c 6c 21 3d 65 3f 65 3a 34 2a 74 2e 6c 65 6e 67 74 68 7d 2c 74 6f 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 7c 7c 66 29 2e 73 74 72 69 6e 67 69 66 79 28 74 68 69 73 29 7d 2c 63 6f 6e 63 61 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 77 6f 72 64 73 2c 6e 3d 74 2e 77 6f 72 64 73 2c 72 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 2c 69 3d 74 2e 73 69 67 42 79 74 65 73 3b 69 66 28 74 68 69 73 2e 63 6c 61 6d 70 28 29 2c 72 25 34 29 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 69 3b 6f 2b 2b 29 7b 76 61 72 20 61 3d 6e 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 72 2b 6f 3e Data Ascii: his.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|f).stringify(this)},concat:function(t){var e=this.words,n=t.words,r=this.sigBytes,i=t.sigBytes;if(this.clamp(),r%4)for(var o=0;o<i;o++){var a=n[o>>>2]>>>24-o%48&255;e[r+o>
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 6e 28 74 29 7b 72 65 74 75 72 6e 20 64 2e 70 61 72 73 65 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 29 29 29 7d 7d 2c 70 3d 63 2e 42 75 66 66 65 72 65 64 42 6c 6f 63 6b 41 6c 67 6f 72 69 74 68 6d 3d 75 2e 65 78 74 65 6e 64 28 7b 72 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 64 61 74 61 3d 6e 65 77 20 73 2e 69 6e 69 74 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 3d 30 7d 2c 5f 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 68 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 Data Ascii: n(t){return d.parse(unescape(encodeURIComponent(t)))}},p=c.BufferedBlockAlgorithm=u.extend({reset:function(){this._data=new s.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=h.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 65 28 72 29 26 26 28 69 3c 38 26 26 28 63 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 2e 35 29 29 29 2c 75 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 31 2f 33 29 29 2c 69 2b 2b 29 2c 72 2b 2b 7d 28 29 3b 76 61 72 20 73 3d 5b 5d 2c 6c 3d 61 2e 53 48 41 32 35 36 3d 6f 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 69 2e 69 6e 69 74 28 63 2e 73 6c 69 63 65 28 30 29 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 74 68 69 73 2e 5f 68 61 73 68 2e 77 6f 72 64 73 2c 72 3d 6e 5b 30 5d 2c 69 3d 6e 5b 31 5d 2c 6f 3d 6e 5b 32 5d 2c 61 3d 6e 5b 33 5d 2c 63 Data Ascii: ar r=2,i=0;i<64;)e(r)&&(i<8&&(c[i]=n(t.pow(r,.5))),u[i]=n(t.pow(r,1/3)),i++),r++}();var s=[],l=a.SHA256=o.extend({_doReset:function(){this._hash=new i.init(c.slice(0))},_doProcessBlock:function(t,e){for(var n=this._hash.words,r=n[0],i=n[1],o=n[2],a=n[3],c
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 74 68 69 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 74 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 79 70 65 6f 66 20 74 2b 22 20 22 2b 74 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 28 63 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 79 20 53 79 6d 62 6f 6c 28 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 29 29 22 29 29 3b 76 61 72 20 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 29 3b 69 66 28 30 3d 3d 3d 72 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 28 5b 5d 29 3b 76 61 72 20 69 3d 72 2e 6c 65 6e 67 74 68 3b 66 75 Data Ascii: function(t){return new this((function(e,n){if(!t\|\|void 0===t.length)return n(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(t);if(0===r.length)return e([]);var i=r.length;fu
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 64 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 70 28 28 72 3d 6e 2c 69 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 61 70 70 6c 79 28 69 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 63 61 74 63 68 28 65 29 7b 66 28 74 2c 65 29 7d 76 61 72 20 72 2c 69 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 29 7b 74 2e 5f 73 74 61 74 65 3d 32 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 74 65 26 26 30 3d 3d 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 26 26 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 28 28 66 75 6e Data Ascii: d(t);if("function"==typeof n)return void p((r=n,i=e,function(){r.apply(i,arguments)}),t)}t._state=1,t._value=e,d(t)}catch(e){f(t,e)}var r,i}function f(t,e){t._state=2,t._value=e,d(t)}function d(t){2===t._state&&0===t._deferreds.length&&u._immediateFn((fun
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 28 74 29 7d 29 29 7d 2c 75 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 61 28 74 29 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 75 2e 72 65 73 6f 6c 76 65 28 74 5b 72 5d 29 2e 74 68 65 6e 28 65 2c 6e 29 7d 29 29 7d 2c 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 26 26 66 75 6e 63 Data Ascii: ew u((function(e,n){n(t)}))},u.race=function(t){return new u((function(e,n){if(!a(t))return n(new TypeError("Promise.race accepts an array"));for(var r=0,i=t.length;r<i;r++)u.resolve(t[r]).then(e,n)}))},u._immediateFn="function"==typeof setImmediate&&func
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 3d 69 29 74 68 72 6f 77 20 6f 3b 72 65 74 75 72 6e 20 43 28 29 7d 66 6f 72 28 6e 2e 6d 65 74 68 6f 64 3d 69 2c 6e 2e 61 72 67 3d 6f 3b 3b 29 7b 76 61 72 20 61 3d 6e 2e 64 65 6c 65 67 61 74 65 3b 69 66 28 61 29 7b 76 61 72 20 63 3d 67 28 61 2c 6e 29 3b 69 66 28 63 29 7b 69 66 28 63 3d 3d 3d 6c 29 63 6f 6e 74 69 6e 75 65 3b 72 65 74 75 72 6e 20 63 7d 7d 69 66 28 22 6e 65 78 74 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 6e 2e 73 65 6e 74 3d 6e 2e 5f 73 65 6e 74 3d 6e 2e 61 72 67 3b 65 6c 73 65 20 69 66 28 22 74 68 72 6f 77 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 7b 69 66 28 22 73 75 73 70 65 6e 64 65 64 53 74 61 72 74 22 3d 3d 3d 72 29 74 68 72 6f 77 20 72 3d 22 63 6f 6d 70 6c 65 74 65 64 22 2c 6e 2e 61 72 67 3b 6e 2e 64 69 73 70 61 74 63 68 45 78 63 65 70 74 69 Data Ascii: =i)throw o;return C()}for(n.method=i,n.arg=o;;){var a=n.delegate;if(a){var c=g(a,n);if(c){if(c===l)continue;return c}}if("next"===n.method)n.sent=n._sent=n.arg;else if("throw"===n.method){if("suspendedStart"===r)throw r="completed",n.arg;n.dispatchExcepti
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 2c 61 29 7d 29 29 7d 72 65 74 75 72 6e 20 72 3d 72 3f 72 2e 74 68 65 6e 28 61 2c 61 29 3a 61 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 2c 65 29 7b 76 61 72 20 6e 3d 74 2e 69 74 65 72 61 74 6f 72 5b 65 2e 6d 65 74 68 6f 64 5d 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6e 29 7b 69 66 28 65 2e 64 65 6c 65 67 61 74 65 3d 6e 75 6c 6c 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 7b 69 66 28 74 2e 69 74 65 72 61 74 6f 72 2e 72 65 74 75 72 6e 26 26 28 65 2e 6d 65 74 68 6f 64 3d 22 72 65 74 75 72 6e 22 2c 65 2e 61 72 67 3d 76 6f 69 64 20 30 2c 67 28 74 2c 65 29 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 29 72 65 74 75 72 6e 20 6c 3b 65 2e 6d 65 74 68 6f 64 3d 22 74 68 72 6f 77 22 2c 65 2e 61 72 67 3d 6e 65 77 20 54 79 70 65 45 72 Data Ascii: ,a)}))}return r=r?r.then(a,a):a()}}function g(t,e){var n=t.iterator[e.method];if(void 0===n){if(e.delegate=null,"throw"===e.method){if(t.iterator.return&&(e.method="return",e.arg=void 0,g(t,e),"throw"===e.method))return l;e.method="throw",e.arg=new TypeEr
2024-04-26 17:13:13 UTC	1379	IN	Data Raw: 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 21 21 65 26 26 28 65 3d 3d 3d 64 7c 7c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 3d 3d 3d 28 65 2e 64 69 73 70 6c 61 79 4e 61 6d 65 7c 7c 65 2e 6e 61 6d 65 29 29 7d 2c 74 2e 6d 61 72 6b 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 68 29 3a 28 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 68 2c 63 28 74 2c 61 2c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 29 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 3d Data Ascii: ion=function(t){var e="function"==typeof t&&t.constructor;return!!e&&(e===d\|\|"GeneratorFunction"===(e.displayName\|\|e.name))},t.mark=function(t){return Object.setPrototypeOf?Object.setPrototypeOf(t,h):(t.__proto__=h,c(t,a,"GeneratorFunction")),t.prototype=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49916	104.18.36.155	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	636	OUT	GET /rum?cm_dsp_id=18&expiry=1729962793&external_user_id=7c305adb-e298-42d1-9636-4375d0a2692c HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	1202	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 17:13:13 GMT Content-Length: 0 Connection: close Location: /rum?cm_dsp_id=18&expiry=1729962793&external_user_id=7c305adb-e298-42d1-9636-4375d0a2692c&C=1 CF-Ray: 87a833c53e863353-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZivgqdHM5R4AAA0lAgBSZAAA; Path=/; Domain=casalemedia.com; Expires=Sat, 26 Apr 2025 17:13:13 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPS=5589; Path=/; Domain=casalemedia.com; Expires=Thu, 25 Jul 2024 17:13:13 GMT; Max-Age=7776000; Secure; SameSite=None Set-Cookie: CMPRO=5589; Path=/; Domain=casalemedia.com; Expires=Thu, 25 Jul 2024 17:13:13 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4f12WhbFbZ3TT8H5bcEX%2FPqJ1%2FJbxzBupxTn3T1we1BJcrcLf2GDgaGGVky4TZd94bXgE8wBDil9yR7O4lUZCaGZCLwZwO60%2FidMUnJ4AwJrgXjbWcjzxnfChpqcu8RWK12WOwFZ%2FeMQDQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49919	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	678	OUT	GET /rp.gif?ts=1714151589124&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:13 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49917	18.215.83.155	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	592	OUT	GET /sync?UIDM=7c305adb-e298-42d1-9636-4375d0a2692c HTTP/1.1 Host: partners.tremorhub.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:13 UTC	513	IN	HTTP/1.1 200 Date: Fri, 26 Apr 2024 17:13:13 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close Server: nginx P3P: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' Set-Cookie: tvid=3e9949ca8da74e63b8ad034d38db3466; Domain=.tremorhub.com; Expires=Sat, 26-Apr-2025 23:01:33 GMT; Path=/; Secure; SameSite=None Set-Cookie: tv_UIDM=7c305adb-e298-42d1-9636-4375d0a2692c; Domain=.tremorhub.com; Expires=Mon, 27-Apr-2026 04:49:53 GMT; Path=/; Secure; SameSite=None
2024-04-26 17:13:13 UTC	49	IN	Data Raw: 32 62 0d 0a 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a Data Ascii: 2bGIF89a!,D;
2024-04-26 17:13:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49922	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:13 UTC	1338	OUT	GET /ddm/fls/z/dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:14 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49923	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	582	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1577951320&_u=YEBAAEAAAAAAACgEK~&z=1747383112 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:15 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49921	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	1302	OUT	GET /ddm/fls/z/dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:15 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49924	52.95.115.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	599	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151592740 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:15 UTC	782	IN	HTTP/1.1 302 Found Server: Server Date: Fri, 26 Apr 2024 17:13:15 GMT Content-Length: 0 Connection: close x-amz-rid: HX6EKY94QQCGH7KHHF8D Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs\|t; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:13:15 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Location: https://aax-eu.amazon-adsystem.com/s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151592740&dcc=t Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49925	13.32.87.128	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	437	OUT	GET /bg9s?x-amz-cf-id=BeXTyI0MEJVnJIqjrGOxN9pPd9PDm3fIDZBHVF6kwmKsSs4xNg8MzQ==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:15 UTC	560	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 2feed206ccd80c991a2378002008d9f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: r-_o5YbzWOwIetX8diH0yC3dP-pN4qhImroI_ZjzXQYc9SAYYVhnKw== Age: 71132 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49926	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	1488	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger, not-navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM
2024-04-26 17:13:16 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:16 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"2489522921115314514","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_typ [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49928	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	1429	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM
2024-04-26 17:13:16 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:16 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"13500114752054870911","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49929	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	775	OUT	POST /ins/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=41434&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 501 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:15 UTC	501	OUT	Data Raw: 7b 22 69 6e 73 22 3a 5b 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 31 34 31 35 31 35 36 38 38 39 34 2c 22 74 69 6d 65 53 69 6e 63 65 4c 6f 61 64 22 3a 31 35 2e 36 34 37 2c 22 62 72 6f 77 73 65 72 57 69 64 74 68 22 3a 31 32 36 33 2c 22 62 72 6f 77 73 65 72 48 65 69 67 68 74 22 3a 39 30 37 2c 22 63 75 72 72 65 6e 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 6e 2e 78 65 72 6f 2e 63 6f 6d 2f 6d 2f 45 6e 31 4d 69 67 55 68 41 32 67 4a 78 53 50 75 78 31 47 43 34 68 44 77 6d 33 53 47 6c 50 4b 52 42 41 6e 44 57 44 4f 31 22 2c 22 70 61 67 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 6e 2e 78 65 72 6f 2e 63 6f 6d 2f 6d 2f 45 6e 31 4d 69 67 55 68 41 32 67 4a 78 53 50 75 78 31 47 43 34 68 44 77 6d 33 53 47 6c 50 4b 52 42 41 6e 44 57 44 4f 31 22 2c 22 65 76 65 Data Ascii: {"ins":[{"timestamp":1714151568894,"timeSinceLoad":15.647,"browserWidth":1263,"browserHeight":907,"currentUrl":"https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1","pageUrl":"https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1","eve
2024-04-26 17:13:16 UTC	264	IN	HTTP/1.1 204 Connection: close date: Fri, 26 Apr 2024 17:13:16 GMT access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760047-MIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49927	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	799	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:16 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:16 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,a4bdb005462b70cf96fd24256449086b,10.0.0.207,10276,102.129.152.220,,361521767297,1,1714151596.025,0.002,,.,0,0,0.000,0.000,-,0,0,203,167,83,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:16 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49930	104.18.36.155	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:15 UTC	702	OUT	GET /rum?cm_dsp_id=18&expiry=1729962793&external_user_id=7c305adb-e298-42d1-9636-4375d0a2692c&C=1 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMID=ZivgqdHM5R4AAA0lAgBSZAAA; CMPS=5589; CMPRO=5589
2024-04-26 17:13:16 UTC	992	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:16 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 87a833d3fb53875a-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZivgqdHM5R4AAA0lAgBSZAAA; Path=/; Domain=casalemedia.com; Expires=Sat, 26 Apr 2025 17:13:16 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=5589; Path=/; Domain=casalemedia.com; Expires=Thu, 25 Jul 2024 17:13:16 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5KM%2FIxFk%2FFJVx3G2MtQHTkRB7OtAgzhA%2BdUCcUqAtuxLcQvi1dv261CrbXRNoamHYTydlGsO9PJaAKt%2FWJ0oP%2FCQu7K%2FI%2B7BVYx9dMsrHGextLYA2adqSgn5LsLXOEWKftouLJ1H4PNFdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-04-26 17:13:16 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49931	68.67.179.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	859	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151591007&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&st=1714151591006&et=1714151591007&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:16 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:16 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:13:16 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49936	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	1091	OUT	GET /ddm/fls/z/dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:16 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:16 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:16 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49934	34.239.87.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	485	OUT	GET /sync?UIDM=7c305adb-e298-42d1-9636-4375d0a2692c HTTP/1.1 Host: partners.tremorhub.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tvid=3e9949ca8da74e63b8ad034d38db3466; tv_UIDM=7c305adb-e298-42d1-9636-4375d0a2692c
2024-04-26 17:13:16 UTC	369	IN	HTTP/1.1 200 Date: Fri, 26 Apr 2024 17:13:16 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close Server: nginx P3P: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' Set-Cookie: tv_UIDM=7c305adb-e298-42d1-9636-4375d0a2692c; Domain=.tremorhub.com; Expires=Mon, 27-Apr-2026 04:49:56 GMT; Path=/; Secure; SameSite=None
2024-04-26 17:13:16 UTC	49	IN	Data Raw: 32 62 0d 0a 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a Data Ascii: 2bGIF89a!,D;
2024-04-26 17:13:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49932	52.95.115.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	646	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151592740&dcc=t HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs\|t
2024-04-26 17:13:17 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:13:16 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: N6S4B2Z03V0QKK5JZZFZ Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:13:16 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:13:16 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:13:17 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49937	18.64.174.54	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	540	OUT	GET /rules-p-W92Yh-Yvb160e.js HTTP/1.1 Host: rules.quantcount.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	660	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3899 Connection: close Date: Fri, 26 Apr 2024 17:13:17 GMT Last-Modified: Thu, 13 Oct 2022 15:29:21 GMT ETag: "6eafacfe7d21f1b942a0d5e1d14679ac" x-amz-server-side-encryption: AES256 Cache-Control: max-age=3600 Accept-Ranges: bytes Server: AmazonS3 Cross-Origin-Resource-Policy: cross-origin access-control-allow-origin: * access-control-allow-methods: GET Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 cd671a08a9a338e6b23ebb6b729dea8c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: CbPKsE7OjUjs2GAZ0jNK-ue0u_DVI8WPM5akjf7GbdBvBi9_OVgSdQ==
2024-04-26 17:13:17 UTC	3899	IN	Data Raw: 2f 2a 0a 20 51 75 61 6e 74 63 61 73 74 20 6d 65 61 73 75 72 65 6d 65 6e 74 20 74 61 67 0a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 38 2d 32 30 32 32 2c 20 51 75 61 6e 74 63 61 73 74 20 43 6f 72 70 2e 0a 2a 2f 0a 27 75 73 65 20 73 74 72 69 63 74 27 3b 28 66 75 6e 63 74 69 6f 6e 28 61 2c 6b 2c 68 29 7b 76 61 72 20 6c 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 65 3d 68 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 65 2e 68 72 65 66 3d 64 3b 72 65 74 75 72 6e 20 65 7d 2c 6d 3d 5b 2f 5e 68 74 74 70 5b 73 5d 3f 3a 5c 2f 5c 2f 28 28 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 2a 29 7c 28 5b 5e 5c 2f 5d 2a 66 6c 73 5c 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 5c 2e 6e 65 74 29 29 5c 2f 2e 2a 7e 6f 72 65 66 3d 28 3f 3c 75 72 6c Data Ascii: /* Quantcast measurement tag Copyright (c) 2008-2022, Quantcast Corp./'use strict';(function(a,k,h){var l=function(d){var e=h.createElement("a");e.href=d;return e},m=[/^http[s]?:\/\/((adservice.google.)\|([^\/]fls\.doubleclick\.net))\/.~oref=(?<url

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49941	192.178.50.70	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 135 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:16 UTC	135	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 32 34 38 39 35 32 32 39 32 31 31 31 35 33 31 34 35 31 34 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"2489522921115314514"},"type":"trigger-no-matching-source"}]
2024-04-26 17:13:17 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:13:17 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49939	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	578	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	664	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCK3Br7EGEgUI6AcQAEIASgA P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=DFeChJjoe3vyUcnXWaAUEVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:13:17 GMT; Secure; SameSite=None Set-Cookie: pxrc=CAA=; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:13:17 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:13:17 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49944	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	1055	OUT	GET /ddm/fls/z/dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:17 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:17 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49942	142.250.189.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:16 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 33 35 30 30 31 31 34 37 35 32 30 35 34 38 37 30 39 31 31 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"13500114752054870911"},"type":"trigger-no-matching-source"}]
2024-04-26 17:13:17 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:13:17 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49946	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	982	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592765&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3403, tp=-1, tpl=-1, uplat=1, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:17 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49950	172.64.151.101	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	502	OUT	GET /rum?cm_dsp_id=18&expiry=1729962793&external_user_id=7c305adb-e298-42d1-9636-4375d0a2692c&C=1 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMID=ZivgqdHM5R4AAA0lAgBSZAAA; CMPS=5589; CMPRO=5589
2024-04-26 17:13:17 UTC	982	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:17 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 87a833da0be731f2-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZivgqdHM5R4AAA0lAgBSZAAA; Path=/; Domain=casalemedia.com; Expires=Sat, 26 Apr 2025 17:13:17 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=5589; Path=/; Domain=casalemedia.com; Expires=Thu, 25 Jul 2024 17:13:17 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DxU%2FLJz24tXjMqDJ6R9N9jKOZ2LIBVBTsqPcbMasMupxEfTUNlxWRJEgG%2B6EmvTxdxkQVUguL4SM23vfbcwJY4k21Potu1V97cAyNWprCpDKu5vgGn60Z31MhLAjCCBnZ0gN3UA6M7dAIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-04-26 17:13:17 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49948	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	1154	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:17 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:17 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"13500114752054870911","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49949	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:16 UTC	1190	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:17 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:17 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"2489522921115314514","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_typ [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49940	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	932	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A11%20GMT&n=-2d&b=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:17 GMT Expires: Fri, 26 Apr 2024 17:13:17 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:13:17 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:13:17 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49947	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	567	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	375	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:17 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,3902aa8bbb7887a561b41ea8fb9a10ab,10.0.0.58,2542,102.129.152.220,,232623411664,1,1714151597.191,0.004,,.,0,0,0.000,0.004,-,0,0,203,267,133,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:17 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49951	68.67.160.75	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	627	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151591007&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&st=1714151591006&et=1714151591007&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:17 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:13:17 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49953	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	1097	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592765&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: not-navigation-source, trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:17 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:17 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:13:17 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49954	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	1090	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592769&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3402, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:17 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49956	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	1200	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592769&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source=navigation-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:18 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:18 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:18 UTC	1577	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:13:18 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49955	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	684	OUT	GET /1000.gif?memo=CI6tHBoNCK3Br7EGEgUI6AcQAEIASgA HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=DFeChJjoe3vyUcnXWaAUEVHnwUo1Dv8b0T3g6ZSscPc=; pxrc=CAA=
2024-04-26 17:13:17 UTC	735	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://segments.company-target.com/log?vendor=liveramp&user_id=Xc129704TbfKOMapYnqCvdyeW4HL9NoXRetZLpqv-QhIvVwgM P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=DFeChJjoe3vyUcnXWaAUEVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:13:17 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:13:17 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:13:17 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49959	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	750	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592765&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3402, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:17 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49957	18.173.166.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	675	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151592740 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Attribution-Reporting-Eligible: trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:13:17 GMT x-amzn-RequestId: 406667af-f3dd-4743-b7dc-45e33d16f06b Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Access-Control-Allow-Credentials: true X-Cache: Miss from cloudfront Via: 1.1 bd7394591e11960c5f8b5b7f1d8f3a30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: VvYswHBiIJsr7tL-FMdn3PFFXwsDoEEyNux_gzIUrezdwfsqgvbIhQ==
2024-04-26 17:13:17 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49960	104.244.42.69	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	1041	OUT	GET /i/adsct?bci=3&eci=2&event_id=72af268f-e21c-40b4-a5ec-d65c3789f18f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4b7afa6c-3ca9-42df-bd91-41dae1996954&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:17 UTC	551	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:17 GMT perf: 7402827104 server: tsa_b set-cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899; Max-Age=63072000; Expires=Sun, 26 Apr 2026 17:13:17 GMT; Path=/; Domain=t.co; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 9e0b48a4587465ef strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: cdf5651ef5f16ec210f189dec259f09d0ae7b707ea487a4a1ec7513e14cb766c connection: close
2024-04-26 17:13:17 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49961	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	807	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A11%20GMT&n=-2d&b=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:13:18 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:12 GMT Expires: Fri, 26 Apr 2024 17:14:12 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:14:12 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49958	67.220.224.144	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	487	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151592740&dcc=t HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:13:18 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:13:18 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: FVDAQBBTXG8KZG1VK39F Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:13:18 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:13:18 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:13:18 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49962	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	858	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592769&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:18 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3402, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:18 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49963	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:17 UTC	787	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592765&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:18 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:18 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:18 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49964	104.244.42.195	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	1058	OUT	GET /i/adsct?bci=3&eci=2&event_id=72af268f-e21c-40b4-a5ec-d65c3789f18f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4b7afa6c-3ca9-42df-bd91-41dae1996954&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:18 UTC	572	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:17 GMT perf: 7402827104 server: tsa_b set-cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="; Max-Age=63072000; Expires=Sun, 26 Apr 2026 17:13:18 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: a7aeb1a4e0e63912 strict-transport-security: max-age=631138519 x-response-time: 78 x-connection-hash: b809574adde769980896da9896ea137b9cffc60e120bd969b8e737cc66742127 connection: close
2024-04-26 17:13:18 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49968	18.173.166.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	436	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151592740 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:18 UTC	378	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:13:18 GMT x-amzn-RequestId: 40634812-275b-4a21-ba24-b206d0bdb97c X-Cache: Miss from cloudfront Via: 1.1 4331afd458444c28f5ee51676df943f6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: xtNkrV_-GlEXmWaZlOp1AuK2M7poQb6Ih7RFWTKQgziGw95z7zOeoQ==
2024-04-26 17:13:18 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49969	13.35.116.64	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	750	OUT	GET /log?vendor=liveramp&user_id=Xc129704TbfKOMapYnqCvdyeW4HL9NoXRetZLpqv-QhIvVwgM HTTP/1.1 Host: segments.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151593\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:18 UTC	316	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 26 Connection: close Date: Fri, 26 Apr 2024 17:13:18 GMT X-Cache: Miss from cloudfront Via: 1.1 fb086f315a09c6603ff2f1e41c8e76fa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: jYYlhEjieiUQ5QrdxVF0XAuYBnN4rvDT38mJaBK1SQTMEYw_cT2Xiw==
2024-04-26 17:13:18 UTC	26	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49970	104.244.42.197	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	863	OUT	GET /i/adsct?bci=3&eci=2&event_id=72af268f-e21c-40b4-a5ec-d65c3789f18f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4b7afa6c-3ca9-42df-bd91-41dae1996954&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:13:18 UTC	392	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:17 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: bc92957b33733164 strict-transport-security: max-age=0 x-response-time: 9 x-connection-hash: a80dc6fb17bcc30d4448b00d9aafe261e626325e406f332a637e709f9497a906 connection: close
2024-04-26 17:13:18 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49967	192.184.68.234	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	1490	OUT	GET /pixel;r=881490543;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151596052;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Manage%20Invoices%20with%20Xero%20Accounting%20Software%2Cdescription.Bookkeeping%20software%20that%20gets%20the%20job%20done%20online%252E%20Flexible%20features%20mean%20you%20c%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Ftry-now%2Fmanage-invoices%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=60b015b6-9d3d-4574-9e48-9d02171d1aaa;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:18 UTC	492	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:18 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: mc=662be0ae-af1d2-68ed6-a5993; expires=Tue, 27-May-2025 17:13:18 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400
2024-04-26 17:13:18 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49972	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	895	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151592769&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151590624&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:19 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:19 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:19 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49973	104.244.42.67	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	884	OUT	GET /i/adsct?bci=3&eci=2&event_id=72af268f-e21c-40b4-a5ec-d65c3789f18f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4b7afa6c-3ca9-42df-bd91-41dae1996954&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:13:19 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:19 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 5341089b1d84468f strict-transport-security: max-age=631138519 x-response-time: 78 x-connection-hash: c2f1dff586783a1280d063c259f6681746634a8cad1e1e7e495860b58598e219 connection: close
2024-04-26 17:13:19 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49974	13.35.116.64	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	518	OUT	GET /log?vendor=liveramp&user_id=Xc129704TbfKOMapYnqCvdyeW4HL9NoXRetZLpqv-QhIvVwgM HTTP/1.1 Host: segments.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151593\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:19 UTC	316	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 26 Connection: close Date: Fri, 26 Apr 2024 17:13:19 GMT X-Cache: Miss from cloudfront Via: 1.1 f5948ee6b325d2018036669902c6e8d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: LhcrVTdqjwNhsrSDag_fzvM-KeStsTi7DRhzV1YP335E75CrJL-8SA==
2024-04-26 17:13:19 UTC	26	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49971	142.250.217.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:18 UTC	1812	OUT	GET /pagead/1p-conversion/1023673485/?random=1489479053&cv=11&fst=1714151590811&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=CPfj1qmxk6qb7QEiEwia6uCmsOCFAxUErYMIHTeaBrYyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqHIxTh9IqoY20LL [TRUNCATED] Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:19 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:19 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49975	192.184.68.234	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:19 UTC	1297	OUT	GET /pixel;r=881490543;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151596052;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Manage%20Invoices%20with%20Xero%20Accounting%20Software%2Cdescription.Bookkeeping%20software%20that%20gets%20the%20job%20done%20online%252E%20Flexible%20features%20mean%20you%20c%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Ftry-now%2Fmanage-invoices%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=60b015b6-9d3d-4574-9e48-9d02171d1aaa;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993
2024-04-26 17:13:19 UTC	354	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:19 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:13:19 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49978	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:19 UTC	550	OUT	GET /async-api.30bd804e-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:19 UTC	813	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2851 x-amz-id-2: KalMgQS4c1RcJ6CBhNsciFgnj/1Yd+8QUgHlVDg3rdz533GL3AgUy0ZYHmhU0AotzJerle8SJ0ziv+s+cD0e9w== x-amz-request-id: E0RXP566PDEPDV1A Last-Modified: Wed, 18 Oct 2023 20:57:40 GMT ETag: "ce1527db8799a0ba1913b5c7b7f666aa" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: ClpGWMCBcYCUYENJA79oj7cgVuH6OaBw Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:19 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760027-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 61 73 79 6e 63 2d 61 70 69 2e 33 30 62 64 38 30 34 65 2d 31 2e 32 33 36 2e 30 2e 6d 69 6e 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 33 39 5d 2c 7b 37 38 37 32 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 6c 65 74 20 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d Data Ascii: /! For license information please see async-api.30bd804e-1.236.0.min.js.LICENSE.txt /"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[439],{7872:(e,t,n)=>{function i(e){var t=this;let n=arguments.length>1&&void 0!==arguments[1]
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 3a 72 2e 72 65 64 75 63 65 28 28 28 65 2c 74 29 3d 3e 28 65 2e 70 75 73 68 28 5b 74 2e 6b 65 79 2c 74 2e 76 61 6c 75 65 5d 29 2c 65 29 29 2c 5b 5d 29 2c 62 6f 64 79 3a 6e 2c 6b 65 65 70 61 6c 69 76 65 3a 21 30 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 6c 65 74 7b 75 72 6c 3a 74 2c 62 6f 64 79 3a 6e 7d 3d 65 3b 74 72 79 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 2e 62 69 6e 64 28 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 29 28 74 2c 6e 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 7d 2c 37 34 33 38 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 73 65 74 41 50 49 3a 28 29 3d 3e 66 7d 29 3b 76 61 72 20 69 3d 6e 28 33 33 32 35 29 2c 72 3d Data Ascii: :r.reduce(((e,t)=>(e.push([t.key,t.value]),e)),[]),body:n,keepalive:!0})}function s(e){let{url:t,body:n}=e;try{return window.navigator.sendBeacon.bind(window.navigator)(t,n)}catch(e){return!1}}},7438:(e,t,n)=>{n.r(t),n.d(t,{setAPI:()=>f});var i=n(3325),r=
2024-04-26 17:13:19 UTC	95	IN	Data Raw: 29 7d 7d 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 28 70 29 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 6c 65 74 5b 6e 2c 69 5d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 73 2e 58 29 28 22 61 70 69 2d 22 2b 6e 2c 69 2c 22 61 70 69 22 2c 74 29 7d 29 29 3b 76 61 72 20 76 3d 30 7d 7d 7d 5d 29 3b Data Ascii: )}}Object.entries(p).forEach((e=>{let[n,i]=e;return(0,s.X)("api-"+n,i,"api",t)}));var v=0}}}]);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49977	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:19 UTC	544	OUT	GET /860.03a8b7a5-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:19 UTC	802	IN	HTTP/1.1 200 OK Connection: close Content-Length: 14276 x-amz-id-2: XtkF0Pn1CwR88XcZ6LeBU27p3rR6ew6rwnPWFvFY+LQw729F7EIOfzx3wdXnn6UxgJx1wBxyCfo= x-amz-request-id: E0RKQ3CWY0WKE2VA Last-Modified: Wed, 18 Oct 2023 20:57:05 GMT ETag: "5c2d33afe15ef1ea0f7dfd3d77677165" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: gB9EP.5ryWZIwH7RQhX4oA68gOyGXPRc Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:19 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760075-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 36 30 5d 2c 7b 33 38 36 30 3a 28 74 2c 65 2c 6e 29 3d 3e 7b 6e 2e 64 28 65 2c 7b 49 4b 3a 28 29 3d 3e 67 2c 77 4f 3a 28 29 3d 3e 62 2c 24 73 3a 28 29 3d 3e 45 7d 29 3b 76 61 72 20 72 3d 6e 28 34 34 30 32 29 2c 69 3d 6e 28 35 30 29 2c 73 3d 6e 28 34 33 35 31 29 2c 6f 3d 6e 28 32 31 37 37 29 3b 63 6c 61 73 73 20 61 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 2c 65 29 7b 69 66 28 21 74 2e 6f 6e 45 6e 64 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6f 6e 45 6e 64 20 68 61 6e 64 6c 65 72 20 69 73 20 72 65 71 75 69 72 65 64 22 29 3b Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[860],{3860:(t,e,n)=>{n.d(e,{IK:()=>g,wO:()=>b,$s:()=>E});var r=n(4402),i=n(50),s=n(4351),o=n(2177);class a{constructor(t,e){if(!t.onEnd)throw new Error("onEnd handler is required");
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 2e 61 62 6f 72 74 28 29 7d 70 61 75 73 65 28 29 7b 74 68 69 73 2e 6f 6e 50 61 75 73 65 28 29 2c 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 74 69 6d 65 72 29 2c 74 68 69 73 2e 72 65 6d 61 69 6e 69 6e 67 4d 73 3d 74 68 69 73 2e 69 6e 69 74 69 61 6c 4d 73 2d 28 44 61 74 65 2e 6e 6f 77 28 29 2d 74 68 69 73 2e 73 74 61 72 74 54 69 6d 65 73 74 61 6d 70 29 7d 72 65 66 72 65 73 68 28 74 2c 65 29 7b 74 68 69 73 2e 63 6c 65 61 72 28 29 2c 74 68 69 73 2e 74 69 6d 65 72 3d 74 68 69 73 2e 63 72 65 61 74 65 28 74 2c 65 29 2c 74 68 69 73 2e 73 74 61 72 74 54 69 6d 65 73 74 61 6d 70 3d 44 61 74 65 2e 6e 6f 77 28 29 2c 74 68 69 73 2e 72 65 6d 61 69 6e 69 6e 67 4d 73 3d 76 6f 69 64 20 30 2c 74 68 69 73 2e 6f 6e 52 65 66 72 65 73 68 28 29 7d 7d 76 61 72 20 64 3d Data Ascii: .abort()}pause(){this.onPause(),clearTimeout(this.timer),this.remainingMs=this.initialMs-(Date.now()-this.startTimestamp)}refresh(t,e){this.clear(),this.timer=this.create(t,e),this.startTimestamp=Date.now(),this.remainingMs=void 0,this.onRefresh()}}var d=
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 68 69 73 29 2c 74 68 69 73 2e 72 65 73 65 74 28 29 7d 2c 6f 6e 52 65 66 72 65 73 68 3a 74 68 69 73 2e 72 65 66 72 65 73 68 2e 62 69 6e 64 28 74 68 69 73 29 2c 6f 6e 52 65 73 75 6d 65 3a 28 29 3d 3e 7b 74 68 69 73 2e 65 65 2e 65 6d 69 74 28 62 2e 52 45 53 55 4d 45 29 7d 2c 6f 6e 50 61 75 73 65 3a 28 29 3d 3e 7b 74 68 69 73 2e 69 6e 69 74 69 61 6c 69 7a 65 64 26 26 74 68 69 73 2e 65 65 2e 65 6d 69 74 28 62 2e 50 41 55 53 45 29 2c 74 68 69 73 2e 77 72 69 74 65 28 28 30 2c 70 2e 44 29 28 74 68 69 73 2e 73 74 61 74 65 2c 77 29 29 7d 2c 65 65 3a 74 68 69 73 2e 65 65 2c 72 65 66 72 65 73 68 45 76 65 6e 74 73 3a 5b 22 63 6c 69 63 6b 22 2c 22 6b 65 79 64 6f 77 6e 22 2c 22 73 63 72 6f 6c 6c 22 5d 7d 2c 74 68 69 73 2e 73 74 61 74 65 2e 69 6e 61 63 74 69 76 65 41 74 Data Ascii: his),this.reset()},onRefresh:this.refresh.bind(this),onResume:()=>{this.ee.emit(b.RESUME)},onPause:()=>{this.initialized&&this.ee.emit(b.PAUSE),this.write((0,p.D)(this.state,w))},ee:this.ee,refreshEvents:["click","keydown","scroll"]},this.state.inactiveAt
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 72 2c 6b 65 79 3a 74 68 69 73 2e 6b 65 79 2c 73 74 6f 72 61 67 65 3a 74 68 69 73 2e 73 74 6f 72 61 67 65 2c 65 78 70 69 72 65 73 4d 73 3a 74 68 69 73 2e 65 78 70 69 72 65 73 4d 73 2c 69 6e 61 63 74 69 76 65 4d 73 3a 74 68 69 73 2e 69 6e 61 63 74 69 76 65 4d 73 7d 29 2c 74 68 69 73 2e 72 65 61 64 28 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 7b 7d 7d 7d 72 65 66 72 65 73 68 28 29 7b 63 6f 6e 73 74 20 74 3d 74 68 69 73 2e 72 65 61 64 28 29 3b 74 68 69 73 2e 77 72 69 74 65 28 7b 2e 2e 2e 74 2c 69 6e 61 63 74 69 76 65 41 74 3a 74 68 69 73 2e 67 65 74 46 75 74 75 72 65 54 69 6d 65 73 74 61 6d 70 28 74 68 69 73 2e 69 6e 61 63 74 69 76 65 4d 73 29 7d 29 7d 69 73 45 78 70 69 72 65 64 28 74 29 7b 72 65 74 75 72 6e 20 44 61 74 65 2e 6e 6f 77 28 29 3e 74 7d Data Ascii: r,key:this.key,storage:this.storage,expiresMs:this.expiresMs,inactiveMs:this.inactiveMs}),this.read()}catch(t){return{}}}refresh(){const t=this.read();this.write({...t,inactiveAt:this.getFutureTimestamp(this.inactiveMs)})}isExpired(t){return Date.now()>t}
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 3d 30 3b 73 3c 72 3b 73 2b 2b 29 69 5b 73 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 3b 74 2e 61 70 70 6c 79 28 65 2c 69 29 7d 7d 7d 6e 2e 64 28 65 2c 7b 44 3a 28 29 3d 3e 72 2c 5a 3a 28 29 3d 3e 69 7d 29 7d 2c 31 32 31 34 3a 28 74 2c 65 2c 6e 29 3d 3e 7b 6e 2e 64 28 65 2c 7b 65 6d 3a 28 29 3d 3e 79 2c 75 35 3a 28 29 3d 3e 6a 2c 51 55 3a 28 29 3d 3e 4f 2c 5f 4c 3a 28 29 3d 3e 4c 2c 47 6d 3a 28 29 3d 3e 24 2c 4c 67 3a 28 29 3d 3e 5f 2c 67 79 3a 28 29 3d 3e 48 2c 42 56 3a 28 29 3d 3e 56 2c 4b 66 3a 28 29 3d 3e 74 74 7d 29 3b 76 61 72 20 72 3d 6e 28 32 31 37 37 29 3b 63 6f 6e 73 74 20 69 3d 22 6e 72 40 6f 72 69 67 69 6e 61 6c 22 3b 76 61 72 20 73 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6f 3d 21 31 3b Data Ascii: =0;s<r;s++)i[s]=arguments[s];t.apply(e,i)}}}n.d(e,{D:()=>r,Z:()=>i})},1214:(t,e,n)=>{n.d(e,{em:()=>y,u5:()=>j,QU:()=>O,_L:()=>L,Gm:()=>$,Lg:()=>_,gy:()=>H,BV:()=>V,Kf:()=>tt});var r=n(2177);const i="nr@original";var s=Object.prototype.hasOwnProperty,o=!1;
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 79 28 74 29 7b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 7c 7c 72 2e 65 65 29 2e 67 65 74 28 22 65 76 65 6e 74 73 22 29 7d 28 74 29 3b 69 66 28 64 5b 65 2e 64 65 62 75 67 49 64 5d 2b 2b 29 72 65 74 75 72 6e 20 65 3b 64 5b 65 2e 64 65 62 75 67 49 64 5d 3d 31 3b 76 61 72 20 6e 3d 61 28 65 2c 21 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 6e 2e 69 6e 50 6c 61 63 65 28 74 2c 5b 6d 2c 76 5d 2c 22 2d 22 2c 73 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 5b 31 5d 7d 72 65 74 75 72 6e 22 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 22 69 6e 20 4f 62 6a 65 63 74 26 26 28 66 2e 69 6c 26 26 67 28 64 6f 63 75 6d 65 6e 74 2c 69 29 2c 67 28 66 2e 5f 41 2c 69 29 2c 67 28 70 2e 70 72 6f 74 6f 74 79 Data Ascii: y(t){var e=function(t){return(t\|\|r.ee).get("events")}(t);if(d[e.debugId]++)return e;d[e.debugId]=1;var n=a(e,!0);function i(t){n.inPlace(t,[m,v],"-",s)}function s(t,e){return t[1]}return"getPrototypeOf"in Object&&(f.il&&g(document,i),g(f._A,i),g(p.prototy
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 74 22 2c 5b 6e 2c 74 5d 2c 6f 29 2c 6f 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 65 6d 69 74 28 72 2b 22 65 6e 64 22 2c 5b 6e 75 6c 6c 2c 74 5d 2c 6f 29 2c 74 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 72 6f 77 20 65 2e 65 6d 69 74 28 72 2b 22 65 6e 64 22 2c 5b 74 5d 2c 6f 29 2c 74 7d 29 29 7d 29 7d 72 65 74 75 72 6e 20 49 5b 65 2e 64 65 62 75 67 49 64 5d 3d 31 2c 45 2e 66 6f 72 45 61 63 68 28 28 74 3d 3e 7b 6e 28 78 5b 4d 5d 2c 74 2c 62 29 2c 6e 28 41 5b 4d 5d 2c 74 2c 62 29 7d 29 29 2c 6e 28 66 2e 5f 41 2c 22 66 65 74 63 68 22 2c 77 29 2c 65 2e 6f 6e 28 77 2b 22 65 6e 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 74 68 69 73 3b 69 66 28 6e 29 7b 76 61 72 20 69 3d 6e 2e 68 65 Data Ascii: t",[n,t],o),o.then((function(t){return e.emit(r+"end",[null,t],o),t}),(function(t){throw e.emit(r+"end",[t],o),t}))})}return I[e.debugId]=1,E.forEach((t=>{n(x[M],t,b),n(A[M],t,b)})),n(f._A,"fetch",w),e.on(w+"end",(function(t,n){var r=this;if(n){var i=n.he
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 66 20 75 2e 70 61 72 65 6e 74 5b 75 2e 6b 65 79 5d 29 72 65 74 75 72 6e 3b 76 61 72 20 68 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 29 7b 65 2e 65 6d 69 74 28 22 6a 73 6f 6e 70 2d 65 6e 64 22 2c 5b 5d 2c 68 29 2c 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6c 2c 28 30 2c 53 2e 6d 24 29 28 21 31 29 29 2c 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 65 72 72 6f 72 22 2c 66 2c 28 30 2c 53 2e 6d 24 29 28 21 31 29 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 29 7b 65 2e 65 6d 69 74 28 22 6a 73 6f 6e 70 2d 65 72 72 6f 72 22 2c 5b 5d 2c 68 29 2c 65 2e 65 6d 69 74 28 22 6a 73 6f 6e 70 2d 65 6e 64 22 2c 5b 5d 2c 68 29 2c 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 Data Ascii: f u.parent[u.key])return;var h={};function l(){e.emit("jsonp-end",[],h),t.removeEventListener("load",l,(0,S.m$)(!1)),t.removeEventListener("error",f,(0,S.m$)(!1))}function f(){e.emit("jsonp-error",[],h),e.emit("jsonp-end",[],h),t.removeEventListener("load
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 6c 22 3d 3d 3d 6e 29 2c 6f 28 21 31 29 29 7d 29 29 3b 63 6f 6e 73 74 20 73 3d 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 73 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 65 6d 69 74 28 22 70 72 6f 70 61 67 61 74 65 22 2c 5b 6e 75 6c 6c 2c 21 69 5d 2c 73 2c 21 31 2c 21 31 29 2c 69 3d 69 7c 7c 21 74 7d 7d 7d 7d 29 29 2c 5b 22 72 65 73 6f 6c 76 65 22 2c 22 72 65 6a 65 63 74 22 5d 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 6f 6e 73 74 20 72 3d 6f 5b 6e 5d 3b 74 5b 6e 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 63 6f 6e 73 74 20 6e 3d 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 74 Data Ascii: l"===n),o(!1))}));const s=r.apply(this,arguments);return s;function o(t){return function(){e.emit("propagate",[null,!i],s,!1,!1),i=i\|\|!t}}}})),["resolve","reject"].forEach((function(n){const r=o[n];t[n]=function(t){const n=r.apply(this,arguments);return t
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 2d 22 2c 5a 3d 5b 55 2c 22 73 65 74 49 6d 6d 65 64 69 61 74 65 22 2c 58 2c 59 2c 22 63 6c 65 61 72 49 6d 6d 65 64 69 61 74 65 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 56 28 74 29 7b 63 6f 6e 73 74 20 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 7c 7c 72 2e 65 65 29 2e 67 65 74 28 22 74 69 6d 65 72 22 29 7d 28 74 29 3b 69 66 28 4b 5b 65 2e 64 65 62 75 67 49 64 5d 2b 2b 29 72 65 74 75 72 6e 20 65 3b 4b 5b 65 2e 64 65 62 75 67 49 64 5d 3d 31 3b 76 61 72 20 6e 3d 61 28 65 29 3b 72 65 74 75 72 6e 20 6e 2e 69 6e 50 6c 61 63 65 28 66 2e 5f 41 2c 5a 2e 73 6c 69 63 65 28 30 2c 32 29 2c 55 2b 57 29 2c 6e 2e 69 6e 50 6c 61 63 65 28 66 2e 5f 41 2c 5a 2e 73 6c 69 63 65 28 32 2c 33 29 2c 58 2b 57 29 2c 6e 2e 69 6e 50 6c 61 63 65 28 66 2e 5f 41 2c 5a 2e Data Ascii: -",Z=[U,"setImmediate",X,Y,"clearImmediate"];function V(t){const e=function(t){return(t\|\|r.ee).get("timer")}(t);if(K[e.debugId]++)return e;K[e.debugId]=1;var n=a(e);return n.inPlace(f._A,Z.slice(0,2),U+W),n.inPlace(f._A,Z.slice(2,3),X+W),n.inPlace(f._A,Z.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49976	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:19 UTC	556	OUT	GET /session-manager.2a64278a-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:19 UTC	801	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1387 x-amz-id-2: DncrG9jZ+x1S26vBEMKYHum7i+dexUrzqIl8OLjlin81YeNHyxfgqY15U/Yp7pbJz2tmPQcqPTQ= x-amz-request-id: E0RW85PD1KJZVGKX Last-Modified: Wed, 18 Oct 2023 21:35:37 GMT ETag: "a097cb2068fb2d63e521cacf139c921d" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: SsYbc40vF7coUg.zeTYgLM88CvSHP8Ac Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:19 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760061-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:19 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 34 32 5d 2c 7b 33 32 32 38 3a 28 74 2c 65 2c 73 29 3d 3e 7b 73 2e 64 28 65 2c 7b 73 65 74 75 70 41 67 65 6e 74 53 65 73 73 69 6f 6e 3a 28 29 3d 3e 68 7d 29 3b 76 61 72 20 6e 3d 73 28 35 37 36 33 29 2c 6f 3d 73 28 38 65 33 29 2c 72 3d 73 28 32 31 37 37 29 2c 63 3d 73 28 34 33 32 32 29 2c 69 3d 73 28 33 38 36 30 29 3b 63 6c 61 73 73 20 61 7b 67 65 74 28 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 74 29 7c 7c 76 6f 69 64 20 30 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 22 Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[242],{3228:(t,e,s)=>{s.d(e,{setupAgentSession:()=>h});var n=s(5763),o=s(8e3),r=s(2177),c=s(4322),i=s(3860);class a{get(t){try{return localStorage.getItem(t)\|\|void 0}catch(t){return"
2024-04-26 17:13:19 UTC	9	IN	Data Raw: 69 6f 6e 7d 7d 7d 5d 29 3b Data Ascii: ion}}}]);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49979	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:19 UTC	1580	OUT	GET /pagead/1p-conversion/1023673485/?random=1489479053&cv=11&fst=1714151590811&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=CPfj1qmxk6qb7QEiEwia6uCmsOCFAxUErYMIHTeaBrYyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqHIxTh9IqoY20LL [TRUNCATED] Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:20 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:20 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:20 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49981	15.197.193.217	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:19 UTC	1032	OUT	GET /track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals HTTP/1.1 Host: insight.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:20 UTC	565	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 17:13:20 GMT Content-Length: 635 Connection: close server: Kestrel location: https://match.adsrvr.org/track/upb/?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/ set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:20 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:20 UTC	635	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 52 65 64 69 72 65 63 74 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 2e 61 64 73 72 76 72 2e 6f 72 67 2f 74 72 61 63 6b 2f 75 70 62 2f 3f 61 64 76 3d 39 6e 6c 72 78 38 70 26 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 74 72 79 2d 6e 6f 77 25 32 46 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 25 32 46 25 33 46 75 74 6d 5f 73 6f 75 72 63 65 25 33 44 78 65 72 6f 2d 69 6e 76 6f 69 63 65 25 32 36 75 74 6d 5f 6d 65 64 69 75 6d 25 33 44 72 65 66 65 72 72 61 6c 25 32 36 75 74 6d 5f 63 61 6d 70 61 69 67 6e 25 33 44 67 6c 6f 62 61 6c 2d 64 2d 6c 66 2d 78 65 72 6f 69 6e 76 6f 69 63 65 72 65 66 65 72 72 61 6c 73 26 75 70 69 64 3d 65 37 Data Ascii: <html><body>Redirect: <a href="https://match.adsrvr.org/track/upb/?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49983	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:20 UTC	560	OUT	GET /lazy-feature-loader.2f55ce66-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:20 UTC	801	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1085 x-amz-id-2: h9Dch89GHoLbxCygSzAQV1j7HOpl+PzcIt9MzA+jLCPpYiwZ60qlp+2QnZV5ROT94qp70Q68oDE= x-amz-request-id: 5PKA1E8C2T2JJFVQ Last-Modified: Wed, 18 Oct 2023 20:58:23 GMT ETag: "e43b565f398109176254b8a9394de5ba" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: AoWWu9_.PBU5bQyJIBgMcnXM0S2uYlqn Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:20 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760067-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:20 UTC	1085	IN	Data Raw: 3b 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 31 32 5d 2c 7b 38 35 38 32 3a 28 65 2c 6e 2c 72 29 3d 3e 7b 72 2e 64 28 6e 2c 7b 6c 61 7a 79 46 65 61 74 75 72 65 4c 6f 61 64 65 72 3a 28 29 3d 3e 74 7d 29 3b 76 61 72 20 61 3d 72 28 33 33 32 35 29 3b 66 75 6e 63 74 69 6f 6e 20 74 28 65 2c 6e 29 7b 69 66 28 22 61 67 67 72 65 67 61 74 65 22 3d 3d 3d 6e 29 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 20 61 2e 44 2e 61 6a 61 78 3a 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 61 6c 6c 28 5b 72 2e 65 28 38 36 30 29 2c 72 2e 65 28 31 34 38 29 2c 72 2e 65 28 38 39 38 29 5d 29 2e 74 68 65 6e Data Ascii: ;"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[412],{8582:(e,n,r)=>{r.d(n,{lazyFeatureLoader:()=>t});var a=r(3325);function t(e,n){if("aggregate"===n)switch(e){case a.D.ajax:return Promise.all([r.e(860),r.e(148),r.e(898)]).then

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49987	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:21 UTC	544	OUT	GET /148.1a20d5fe-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	801	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7826 x-amz-id-2: NyFh/ouNGswXpKrD4DJoVA3u9LmIv6ER14o1kjIQSjlfRWw2ioia6iEM+YcTWbQxWl6IqlXkvOw= x-amz-request-id: W4QAYYHHWDVQMP6K Last-Modified: Wed, 18 Oct 2023 20:56:04 GMT ETag: "bed1f74897d091a7dfc2b06e8a1e29a3" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: 27hyUF2MmzVIZmpgRHUgD0gF9836bmSx Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760044-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 31 34 38 2e 31 61 32 30 64 35 66 65 2d 31 2e 32 33 36 2e 30 2e 6d 69 6e 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 34 38 5d 2c 7b 38 36 37 33 3a 28 74 2c 65 2c 6e 29 3d 3e 7b 6e 2e 64 28 65 2c 7b 4d 3a 28 29 3d 3e 43 7d 29 3b 76 61 72 20 73 3d 6e 28 31 32 38 34 29 2c 72 3d 6e 28 34 33 35 31 29 2c 61 3d 7b 22 25 32 43 22 3a 22 2c 22 2c 22 25 33 41 22 3a 22 3a 22 2c 22 25 32 46 22 3a 22 2f 22 2c 22 25 34 30 Data Ascii: /! For license information please see 148.1a20d5fe-1.236.0.min.js.LICENSE.txt /"use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[148],{8673:(t,e,n)=>{n.d(e,{M:()=>C});var s=n(1284),r=n(4351),a={"%2C":",","%3A":":","%2F":"/","%40
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 74 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 2c 22 68 61 72 76 65 73 74 2e 74 6f 6f 4d 61 6e 79 52 65 71 75 65 73 74 73 44 65 6c 61 79 22 29 7c 7c 36 30 2c 74 68 69 73 2e 6f 62 66 75 73 63 61 74 6f 72 3d 6e 65 77 20 76 2e 52 52 28 74 68 69 73 2e 73 68 61 72 65 64 43 6f 6e 74 65 78 74 29 2c 74 68 69 73 2e 67 65 74 53 63 68 65 6d 65 3d 28 29 3d 3e 21 31 3d 3d 3d 28 30 2c 79 2e 4d 74 29 28 74 68 69 73 2e 73 68 61 72 65 64 43 6f 6e 74 65 78 74 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 2c 22 73 73 6c 22 29 3f 22 68 74 74 70 22 3a 22 68 74 74 70 73 22 2c 74 68 69 73 2e 5f 65 76 65 6e 74 73 3d 7b 7d 7d 73 65 6e 64 58 28 29 7b 6c 65 74 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e Data Ascii: t.agentIdentifier,"harvest.tooManyRequestsDelay")\|\|60,this.obfuscator=new v.RR(this.sharedContext),this.getScheme=()=>!1===(0,y.Mt)(this.sharedContext.agentIdentifier,"ssl")?"http":"https",this._events={}}sendX(){let t=arguments.length>0&&void 0!==argumen
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 63 6f 6e 63 61 74 28 65 29 3a 22 22 2c 22 2f 31 2f 22 29 2e 63 6f 6e 63 61 74 28 64 2e 6c 69 63 65 6e 73 65 4b 65 79 29 3b 6f 26 26 28 76 3d 6f 29 2c 63 26 26 28 76 3d 22 22 2e 63 6f 6e 63 61 74 28 74 68 69 73 2e 67 65 74 53 63 68 65 6d 65 28 29 2c 22 3a 2f 2f 22 29 2e 63 6f 6e 63 61 74 28 64 2e 65 72 72 6f 72 42 65 61 63 6f 6e 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 29 29 3b 63 6f 6e 73 74 20 6d 3d 21 63 26 26 75 3f 74 68 69 73 2e 62 61 73 65 51 75 65 72 79 53 74 72 69 6e 67 28 29 3a 22 22 3b 6c 65 74 20 78 3d 6c 28 70 2c 66 2e 6d 61 78 42 79 74 65 73 29 3b 61 7c 7c 28 61 3d 68 2e 71 44 28 7b 69 73 46 69 6e 61 6c 48 61 72 76 65 73 74 3a 73 2e 75 6e 6c 6f 61 64 7d 29 29 2c 22 22 3d 3d 3d 6d 26 26 78 2e 73 74 61 72 74 73 57 69 74 68 28 22 26 22 29 26 26 Data Ascii: concat(e):"","/1/").concat(d.licenseKey);o&&(v=o),c&&(v="".concat(this.getScheme(),"://").concat(d.errorBeacon,"/").concat(e));const m=!c&&u?this.baseQueryString():"";let x=l(p,f.maxBytes);a\|\|(a=h.qD({isFinalHarvest:s.unload})),""===m&&x.startsWith("&")&&
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 61 63 74 69 6f 6e 29 2c 22 26 72 73 74 3d 22 2b 28 30 2c 70 2e 7a 29 28 29 2c 22 26 63 6b 3d 30 22 2c 22 26 73 3d 22 2b 28 74 2e 73 65 73 73 69 6f 6e 3f 2e 73 74 61 74 65 2e 76 61 6c 75 65 7c 7c 22 30 22 29 2c 64 28 22 72 65 66 22 2c 73 29 2c 64 28 22 70 74 69 64 22 2c 74 2e 70 74 69 64 3f 22 22 2b 74 2e 70 74 69 64 3a 22 22 29 5d 2e 6a 6f 69 6e 28 22 22 29 7d 63 72 65 61 74 65 50 61 79 6c 6f 61 64 28 74 2c 65 29 7b 63 6f 6e 73 74 20 6e 3d 74 68 69 73 2e 5f 65 76 65 6e 74 73 5b 74 5d 2c 73 3d 7b 62 6f 64 79 3a 7b 7d 2c 71 73 3a 7b 7d 7d 3b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 29 66 6f 72 28 6c 65 74 20 74 3d 30 3b 74 3c 6e 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 63 6f 6e 73 74 20 72 3d 6e 5b 74 5d 28 Data Ascii: action),"&rst="+(0,p.z)(),"&ck=0","&s="+(t.session?.state.value\|\|"0"),d("ref",s),d("ptid",t.ptid?""+t.ptid:"")].join("")}createPayload(t,e){const n=this._events[t],s={body:{},qs:{}};if(Array.isArray(n)&&n.length>0)for(let t=0;t<n.length;t++){const r=n[t](
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 6e 74 49 64 65 6e 74 69 66 69 65 72 29 2e 6c 65 6e 67 74 68 3e 30 7d 6f 62 66 75 73 63 61 74 65 53 74 72 69 6e 67 28 74 29 7b 69 66 28 21 74 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 29 72 65 74 75 72 6e 20 74 3b 66 6f 72 28 76 61 72 20 65 3d 75 28 74 68 69 73 2e 73 68 61 72 65 64 43 6f 6e 74 65 78 74 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 2c 6e 3d 74 2c 73 3d 30 3b 73 3c 65 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 7b 76 61 72 20 72 3d 65 5b 73 5d 2e 72 65 67 65 78 2c 61 3d 65 5b 73 5d 2e 72 65 70 6c 61 63 65 6d 65 6e 74 7c 7c 22 2a 22 3b 6e 3d 6e 2e 72 65 70 6c 61 63 65 28 72 2c 61 29 7d 72 65 74 75 72 6e 20 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 74 29 7b 76 61 72 20 65 3d 5b 5d 2c 6e 3d 28 30 2c 73 2e 4d 74 29 28 74 2c 22 6f Data Ascii: ntIdentifier).length>0}obfuscateString(t){if(!t\|\|"string"!=typeof t)return t;for(var e=u(this.sharedContext.agentIdentifier),n=t,s=0;s<e.length;s++){var r=e[s].regex,a=e[s].replacement\|\|"*";n=n.replace(r,a)}return n}}function u(t){var e=[],n=(0,s.Mt)(t,"o
2024-04-26 17:13:22 UTC	936	IN	Data Raw: 5b 7b 6b 65 79 3a 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 76 61 6c 75 65 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 7d 5d 7d 3d 74 3b 72 65 74 75 72 6e 20 66 65 74 63 68 28 65 2c 7b 6d 65 74 68 6f 64 3a 73 2c 68 65 61 64 65 72 73 3a 72 2e 72 65 64 75 63 65 28 28 28 74 2c 65 29 3d 3e 28 74 2e 70 75 73 68 28 5b 65 2e 6b 65 79 2c 65 2e 76 61 6c 75 65 5d 29 2c 74 29 29 2c 5b 5d 29 2c 62 6f 64 79 3a 6e 2c 6b 65 65 70 61 6c 69 76 65 3a 21 30 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 6c 65 74 7b 75 72 6c 3a 65 2c 62 6f 64 79 3a 6e 7d 3d 74 3b 74 72 79 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 2e 62 69 6e 64 28 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 29 28 65 2c 6e 29 7d 63 61 74 63 Data Ascii: [{key:"content-type",value:"text/plain"}]}=t;return fetch(e,{method:s,headers:r.reduce(((t,e)=>(t.push([e.key,e.value]),t)),[]),body:n,keepalive:!0})}function o(t){let{url:e,body:n}=t;try{return window.navigator.sendBeacon.bind(window.navigator)(e,n)}catc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49988	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:21 UTC	567	OUT	GET /page_view_timing-aggregate.bd6de33a-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	822	IN	HTTP/1.1 200 OK Connection: close Content-Length: 14879 x-amz-id-2: jM0oF3l5e3ov8Gy0+agKFxJKqE5F3gGOn9+B5qtiHwSj+ARggb1vByZ7JT7XyqCaptLsSw13YHoKVu2+5tZS6Jj6+nY+y85X x-amz-request-id: W4Q3S1HJYBARNA5F Last-Modified: Wed, 18 Oct 2023 21:34:59 GMT ETag: "01e96e9ff5c360298d13581ad38e60a8" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: 34JJvT_Hc26HhyXntOX8fvZ9mloIy.Ma Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760082-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 33 34 38 5d 2c 7b 32 35 37 33 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 64 28 74 2c 7b 6f 3a 28 29 3d 3e 63 7d 29 3b 76 61 72 20 69 3d 6e 28 34 32 34 37 29 2c 72 3d 6e 28 31 31 31 37 29 2c 61 3d 6e 28 38 36 37 33 29 2c 73 3d 6e 28 38 33 31 30 29 2c 6f 3d 6e 28 35 37 36 33 29 2c 75 3d 6e 28 33 38 36 30 29 3b 63 6c 61 73 73 20 63 20 65 78 74 65 6e 64 73 20 72 2e 77 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 6e 29 7b 73 75 70 65 72 28 6e 29 2c 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 3d 65 2c 74 68 69 73 2e 6f 70 74 73 3d 74 7c 7c 7b 7d Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[348],{2573:(e,t,n)=>{n.d(t,{o:()=>c});var i=n(4247),r=n(1117),a=n(8673),s=n(8310),o=n(5763),u=n(3860);class c extends r.w{constructor(e,t,n){super(n),this.endpoint=e,this.opts=t\|\|{}
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 72 29 3f 72 3a 5b 72 5d 2c 61 2e 70 75 73 68 28 2e 2e 2e 72 29 7d 6c 65 74 20 73 3d 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 58 28 65 29 3b 61 2e 6c 65 6e 67 74 68 3f 73 3d 74 68 69 73 2e 6f 70 74 73 2e 72 61 77 3f 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 5f 73 65 6e 64 28 65 29 3a 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 28 65 29 3a 61 2e 70 75 73 68 28 76 6f 69 64 20 30 29 2c 61 2e 66 6f 72 45 61 63 68 28 28 69 3d 3e 7b 73 28 7b 65 6e 64 70 6f 69 6e 74 3a 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 2c 70 61 79 6c 6f 61 64 3a 69 2c 6f 70 74 73 3a 65 2c 73 75 62 6d 69 74 4d 65 74 68 6f 64 3a 6e 2c 63 62 46 69 6e 69 73 68 65 64 3a 74 2c 63 75 73 74 6f 6d 55 72 Data Ascii: type.toString.call(r)?r:[r],a.push(...r)}let s=e=>this.harvest.sendX(e);a.length?s=this.opts.raw?e=>this.harvest._send(e):e=>this.harvest.send(e):a.push(void 0),a.forEach((i=>{s({endpoint:this.endpoint,payload:i,opts:e,submitMethod:n,cbFinished:t,customUr
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 72 22 3a 73 3d 36 2c 61 3d 69 25 31 3f 69 3a 69 2b 22 2e 22 3b 62 72 65 61 6b 3b 63 61 73 65 22 62 6f 6f 6c 65 61 6e 22 3a 73 3d 69 3f 37 3a 38 3b 62 72 65 61 6b 3b 63 61 73 65 22 75 6e 64 65 66 69 6e 65 64 22 3a 73 3d 39 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 61 3d 74 28 69 29 7d 6e 2e 70 75 73 68 28 5b 73 2c 65 2b 28 61 3f 22 2c 22 2b 61 3a 22 22 29 5d 29 7d 7d 29 29 2c 6e 7d 76 61 72 20 68 3d 2f 28 5b 2c 5c 5c 3b 5d 29 2f 67 7d 2c 38 33 31 30 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 64 28 74 2c 7b 4c 3a 28 29 3d 3e 6f 7d 29 3b 76 61 72 20 69 3d 6e 28 33 32 33 39 29 2c 72 3d 6e 28 37 38 37 32 29 2c 61 3d 6e 28 33 38 35 29 2c 73 3d 6e 28 37 39 35 36 29 3b 69 66 28 61 2e 76 36 29 7b 61 2e 5f 41 2e 63 6c 65 61 6e 75 70 54 61 73 6b 73 3d 5b 5d 3b 63 6f Data Ascii: r":s=6,a=i%1?i:i+".";break;case"boolean":s=i?7:8;break;case"undefined":s=9;break;default:a=t(i)}n.push([s,e+(a?","+a:"")])}})),n}var h=/([,\\;])/g},8310:(e,t,n)=>{n.d(t,{L:()=>o});var i=n(3239),r=n(7872),a=n(385),s=n(7956);if(a.v6){a._A.cleanupTasks=[];co
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 79 7b 69 66 28 21 6f 29 7b 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 28 22 70 61 69 6e 74 22 29 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 3d 3d 3d 65 2e 6e 61 6d 65 26 26 74 68 69 73 2e 61 64 64 54 69 6d 69 6e 67 28 22 66 63 70 22 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2e 73 74 61 72 74 54 69 6d 65 29 29 7d 29 29 7d 7d 63 61 74 63 68 28 65 29 7b 7d 65 6c 73 65 28 30 2c 69 2e 61 34 29 28 28 65 3d 3e 7b 6c 65 74 7b 6e 61 6d 65 3a 74 2c 76 61 6c 75 65 3a 6e 7d 3d 65 3b 6f 7c 7c 74 68 69 73 2e 61 6c 72 65 61 64 79 53 65 6e 74 2e 68 61 73 28 74 29 7c 7c 28 74 68 69 73 2e 61 6c 72 65 61 64 79 53 65 6e 74 2e 61 64 64 28 74 29 2c 74 68 69 73 2e 61 64 Data Ascii: y{if(!o){performance.getEntriesByType("paint").forEach((e=>{"first-contentful-paint"===e.name&&this.addTiming("fcp",Math.floor(e.startTime))}))}}catch(e){}else(0,i.a4)((e=>{let{name:t,value:n}=e;o\|\|this.alreadySent.has(t)\|\|(this.alreadySent.add(t),this.ad
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 72 4e 61 6d 65 3a 74 2e 61 74 74 72 69 62 75 74 69 6f 6e 5b 30 5d 2e 63 6f 6e 74 61 69 6e 65 72 4e 61 6d 65 7d 29 2c 65 28 6e 29 7d 29 29 7d 3b 6c 65 74 20 6e 3b 74 72 79 7b 50 65 72 66 6f 72 6d 61 6e 63 65 4f 62 73 65 72 76 65 72 2e 73 75 70 70 6f 72 74 65 64 45 6e 74 72 79 54 79 70 65 73 2e 69 6e 63 6c 75 64 65 73 28 22 6c 6f 6e 67 74 61 73 6b 22 29 26 26 28 6e 3d 6e 65 77 20 50 65 72 66 6f 72 6d 61 6e 63 65 4f 62 73 65 72 76 65 72 28 28 65 3d 3e 7b 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 29 2e 74 68 65 6e 28 28 28 29 3d 3e 7b 74 28 65 2e 67 65 74 45 6e 74 72 69 65 73 28 29 29 7d 29 29 7d 29 29 2c 6e 2e 6f 62 73 65 72 76 65 28 7b 74 79 70 65 3a 22 6c 6f 6e 67 74 61 73 6b 22 2c 62 75 66 66 65 72 65 64 3a 21 30 7d 29 29 7d 63 61 74 63 68 28 65 29 Data Ascii: rName:t.attribution[0].containerName}),e(n)}))};let n;try{PerformanceObserver.supportedEntryTypes.includes("longtask")&&(n=new PerformanceObserver((e=>{Promise.resolve().then((()=>{t(e.getEntries())}))})),n.observe({type:"longtask",buffered:!0}))}catch(e)
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 72 64 65 64 7c 7c 28 74 68 69 73 2e 61 64 64 54 69 6d 69 6e 67 28 22 70 61 67 65 48 69 64 65 22 2c 65 2c 6e 75 6c 6c 29 2c 74 68 69 73 2e 63 75 72 53 65 73 73 45 6e 64 52 65 63 6f 72 64 65 64 3d 21 30 29 7d 72 65 63 6f 72 64 50 61 67 65 55 6e 6c 6f 61 64 28 65 29 7b 74 68 69 73 2e 61 64 64 54 69 6d 69 6e 67 28 22 75 6e 6c 6f 61 64 22 2c 65 2c 6e 75 6c 6c 29 2c 74 68 69 73 2e 65 6e 64 43 75 72 72 65 6e 74 53 65 73 73 69 6f 6e 28 65 29 7d 61 64 64 54 69 6d 69 6e 67 28 65 2c 74 2c 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 2c 6e 75 6c 6c 21 3d 3d 74 68 69 73 2e 63 6c 73 26 26 28 6e 2e 63 6c 73 3d 74 68 69 73 2e 63 6c 73 29 2c 74 68 69 73 2e 74 69 6d 69 6e 67 73 2e 70 75 73 68 28 7b 6e 61 6d 65 3a 65 2c 76 61 6c 75 65 3a 74 2c 61 74 74 72 73 3a 6e 7d 29 2c 28 30 2c 68 2e Data Ascii: rded\|\|(this.addTiming("pageHide",e,null),this.curSessEndRecorded=!0)}recordPageUnload(e){this.addTiming("unload",e,null),this.endCurrentSession(e)}addTiming(e,t,n){n=n\|\|{},null!==this.cls&&(n.cls=this.cls),this.timings.push({name:e,value:t,attrs:n}),(0,h.
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 28 74 29 29 7d 29 2c 21 30 29 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 26 26 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 28 22 6e 61 76 69 67 61 74 69 6f 6e 22 29 5b 30 5d 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 64 28 29 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 61 63 74 69 76 61 74 69 6f 6e 53 74 61 72 74 7c 7c 30 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 64 28 29 2c 69 3d 22 6e 61 76 69 67 61 74 65 22 3b 72 65 74 75 72 6e 20 75 3e 3d 30 3f 69 3d 22 62 61 63 6b 2d 66 6f 72 77 61 72 64 2d 63 61 63 68 Data Ascii: (t))}),!0)},d=function(){return window.performance&&performance.getEntriesByType&&performance.getEntriesByType("navigation")[0]},l=function(){var e=d();return e&&e.activationStart\|\|0},h=function(e,t){var n=d(),i="navigate";return u>=0?i="back-forward-cach
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 7c 7c 64 6f 63 75 6d 65 6e 74 2e 70 72 65 72 65 6e 64 65 72 69 6e 67 3f 31 2f 30 3a 30 7d 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 68 69 64 64 65 6e 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 26 26 79 3e 2d 31 26 26 28 79 3d 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 3d 3d 3d 65 2e 74 79 70 65 3f 65 2e 74 69 6d 65 53 74 61 6d 70 3a 30 2c 53 28 29 29 7d 2c 77 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 54 2c 21 30 29 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 72 65 72 65 6e 64 65 72 69 6e 67 63 68 61 6e 67 65 Data Ascii: =document.visibilityState\|\|document.prerendering?1/0:0},T=function(e){"hidden"===document.visibilityState&&y>-1&&(y="visibilitychange"===e.type?e.timeStamp:0,S())},w=function(){addEventListener("visibilitychange",T,!0),addEventListener("prerenderingchange
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 2c 69 2c 50 2c 74 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 2c 76 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 28 6f 2e 74 61 6b 65 52 65 63 6f 72 64 73 28 29 29 2c 6e 28 21 30 29 7d 29 29 2c 63 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 3d 30 2c 69 3d 68 28 22 43 4c 53 22 2c 30 29 2c 6e 3d 6d 28 65 2c 69 2c 50 2c 74 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 2c 70 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 28 29 7d 29 29 7d 29 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 6e 2c 30 29 29 7d 29 29 29 7d 2c 6b 3d 7b 70 61 73 73 69 76 65 3a 21 30 2c 63 61 70 74 75 72 65 3a 21 30 7d 2c 46 3d 6e 65 77 20 44 61 74 65 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 7c 7c 28 69 3d 74 2c 72 3d 65 2c 61 3d 6e 65 77 20 44 61 74 Data Ascii: ,i,P,t.reportAllChanges),v((function(){s(o.takeRecords()),n(!0)})),c((function(){r=0,i=h("CLS",0),n=m(e,i,P,t.reportAllChanges),p((function(){return n()}))})),setTimeout(n,0))})))},k={passive:!0,capture:!0},F=new Date,I=function(e,t){i\|\|(i=t,r=e,a=new Dat
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 70 75 73 68 28 61 29 2c 4d 28 29 7d 29 29 7d 29 29 7d 2c 44 3d 30 2c 78 3d 31 2f 30 2c 6a 3d 30 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 74 65 72 61 63 74 69 6f 6e 49 64 26 26 28 78 3d 4d 61 74 68 2e 6d 69 6e 28 78 2c 65 2e 69 6e 74 65 72 61 63 74 69 6f 6e 49 64 29 2c 6a 3d 4d 61 74 68 2e 6d 61 78 28 6a 2c 65 2e 69 6e 74 65 72 61 63 74 69 6f 6e 49 64 29 2c 44 3d 6a 3f 28 6a 2d 78 29 2f 37 2b 31 3a 30 29 7d 29 29 7d 2c 55 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 3f 44 3a 70 65 72 66 6f 72 6d 61 6e 63 65 2e 69 6e 74 65 72 61 63 74 69 6f 6e 43 6f 75 6e 74 7c 7c 30 7d 2c 58 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 69 6e 74 65 72 61 63 74 69 6f 6e 43 6f 75 6e Data Ascii: push(a),M()}))}))},D=0,x=1/0,j=0,B=function(e){e.forEach((function(e){e.interactionId&&(x=Math.min(x,e.interactionId),j=Math.max(j,e.interactionId),D=j?(j-x)/7+1:0)}))},U=function(){return o?D:performance.interactionCount\|\|0},X=function(){"interactionCoun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49990	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:21 UTC	559	OUT	GET /jserrors-aggregate.49e41428-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	801	IN	HTTP/1.1 200 OK Connection: close Content-Length: 9489 x-amz-id-2: pYCURsBVBmweu+5Kj/tYd/2kc/Eo+6VSX7P355oBHA5AKsp9ZnGmeJm6DfmJhXHO/PTtC/cWubs= x-amz-request-id: W4Q5R19JMMQ603HY Last-Modified: Wed, 18 Oct 2023 20:58:09 GMT ETag: "ea0f213ac446fa34c085f244b9573b9d" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: gtBM4GKuMukahVd9NQUYfXgsxiTAdQL3 Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760082-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 33 31 37 5d 2c 7b 32 35 37 33 3a 28 65 2c 74 2c 72 29 3d 3e 7b 72 2e 64 28 74 2c 7b 6f 3a 28 29 3d 3e 68 7d 29 3b 76 61 72 20 73 3d 72 28 34 32 34 37 29 2c 6e 3d 72 28 31 31 31 37 29 2c 69 3d 72 28 38 36 37 33 29 2c 61 3d 72 28 38 33 31 30 29 2c 6f 3d 72 28 35 37 36 33 29 2c 63 3d 72 28 33 38 36 30 29 3b 63 6c 61 73 73 20 68 20 65 78 74 65 6e 64 73 20 6e 2e 77 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 72 29 7b 73 75 70 65 72 28 72 29 2c 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 3d 65 2c 74 68 69 73 2e 6f 70 74 73 3d 74 7c 7c 7b 7d Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[317],{2573:(e,t,r)=>{r.d(t,{o:()=>h});var s=r(4247),n=r(1117),i=r(8673),a=r(8310),o=r(5763),c=r(3860);class h extends n.w{constructor(e,t,r){super(r),this.endpoint=e,this.opts=t\|\|{}
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 6e 29 3f 6e 3a 5b 6e 5d 2c 69 2e 70 75 73 68 28 2e 2e 2e 6e 29 7d 6c 65 74 20 61 3d 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 58 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3f 61 3d 74 68 69 73 2e 6f 70 74 73 2e 72 61 77 3f 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 5f 73 65 6e 64 28 65 29 3a 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 28 65 29 3a 69 2e 70 75 73 68 28 76 6f 69 64 20 30 29 2c 69 2e 66 6f 72 45 61 63 68 28 28 73 3d 3e 7b 61 28 7b 65 6e 64 70 6f 69 6e 74 3a 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 2c 70 61 79 6c 6f 61 64 3a 73 2c 6f 70 74 73 3a 65 2c 73 75 62 6d 69 74 4d 65 74 68 6f 64 3a 72 2c 63 62 46 69 6e 69 73 68 65 64 3a 74 2c 63 75 73 74 6f 6d 55 72 Data Ascii: type.toString.call(n)?n:[n],i.push(...n)}let a=e=>this.harvest.sendX(e);i.length?a=this.opts.raw?e=>this.harvest._send(e):e=>this.harvest.send(e):i.push(void 0),i.forEach((s=>{a({endpoint:this.endpoint,payload:s,opts:e,submitMethod:r,cbFinished:t,customUr
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 2e 72 65 70 6c 61 63 65 28 69 2c 22 22 29 7d 76 61 72 20 6f 3d 72 28 33 38 35 29 2c 63 3d 72 28 34 32 32 32 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 29 72 65 74 75 72 6e 22 22 3b 63 6f 6e 73 74 20 74 3d 28 30 2c 63 2e 66 29 28 65 29 3b 72 65 74 75 72 6e 20 74 3d 3d 3d 28 30 2c 63 2e 66 29 28 6f 2e 46 4e 29 3f 22 3c 69 6e 6c 69 6e 65 3e 22 3a 74 7d 76 61 72 20 75 3d 21 31 2c 64 3d 2f 66 75 6e 63 74 69 6f 6e 20 28 2e 2b 3f 29 5c 73 2a 5c 28 2f 2c 6c 3d 2f 5e 5c 73 2a 61 74 20 28 3f 3a 28 28 3f 3a 5c 5b 6f 62 6a 65 63 74 20 6f 62 6a 65 63 74 5c 5d 29 3f 28 3f 3a 5b 5e 28 5d 2a 5c 28 5b 5e 29 5d 2a 5c 29 29 2a 5b 5e 28 29 5d 2a 28 3f 3a 20 5c 5b 61 73 20 5c 53 2b 5c 5d 29 3f 29 20 29 3f 5c Data Ascii: .replace(i,"")}var o=r(385),c=r(4222);function h(e){if("string"!=typeof e)return"";const t=(0,c.f)(e);return t===(0,c.f)(o.FN)?"<inline>":t}var u=!1,d=/function (.+?)\s$/,l=/^\sat (?:((?:\[object object\])?(?:[^(]\([^)]$)[^()](?: \[as \S+\])?) )?\
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 61 6d 65 7c 7c 6b 28 65 29 3b 72 65 74 75 72 6e 20 74 3f 7b 6d 6f 64 65 3a 22 6e 61 6d 65 6f 6e 6c 79 22 2c 6e 61 6d 65 3a 74 2c 6d 65 73 73 61 67 65 3a 65 2e 6d 65 73 73 61 67 65 2c 73 74 61 63 6b 53 74 72 69 6e 67 3a 74 2b 22 3a 20 22 2b 65 2e 6d 65 73 73 61 67 65 2c 66 72 61 6d 65 73 3a 5b 5d 7d 3a 6e 75 6c 6c 7d 28 65 29 2c 74 29 72 65 74 75 72 6e 20 74 7d 63 61 74 63 68 28 65 29 7b 75 7d 72 65 74 75 72 6e 7b 6d 6f 64 65 3a 22 66 61 69 6c 65 64 22 2c 73 74 61 63 6b 53 74 72 69 6e 67 3a 22 22 2c 66 72 61 6d 65 73 3a 5b 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 65 2c 74 29 7b 6c 65 74 20 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 6d 61 74 63 68 28 66 29 3b 74 7c 7c 28 74 3d 65 2e 6d 61 74 63 68 28 6c 29 29 3b 69 66 28 74 29 72 65 Data Ascii: ame\|\|k(e);return t?{mode:"nameonly",name:t,message:e.message,stackString:t+": "+e.message,frames:[]}:null}(e),t)return t}catch(e){u}return{mode:"failed",stackString:"",frames:[]}}function v(e,t){let r=function(e){var t=e.match(f);t\|\|(t=e.match(l));if(t)re
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 2e 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 68 69 73 2e 66 65 61 74 75 72 65 4e 61 6d 65 2c 74 68 69 73 2e 65 65 29 2c 28 30 2c 79 2e 58 29 28 22 69 65 72 72 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 73 74 6f 72 65 45 72 72 6f 72 28 2e 2e 2e 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 68 69 73 2e 66 65 61 74 75 72 65 4e 61 6d 65 2c 74 68 69 73 2e 65 65 29 3b 63 6f 6e 73 74 20 73 3d 28 30 2c 77 2e 4d 74 29 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 2c 22 6a 73 65 72 72 6f 72 73 2e 68 61 72 76 65 73 74 54 69 6d 65 53 65 63 6f 6e 64 73 22 29 7c 7c 31 30 2c 6e 3d 6e 65 77 20 5f 2e 6f 28 22 6a 73 65 72 72 6f 72 73 22 2c 7b 6f 6e 46 69 6e 69 73 68 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e Data Ascii: .arguments)}),this.featureName,this.ee),(0,y.X)("ierr",(function(){return r.storeError(...arguments)}),this.featureName,this.ee);const s=(0,w.Mt)(this.agentIdentifier,"jserrors.harvestTimeSeconds")\|\|10,n=new _.o("jserrors",{onFinished:function(){return r.
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 20 74 3d 22 22 2c 72 3d 30 3b 72 3c 65 2e 66 72 61 6d 65 73 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 73 3d 65 2e 66 72 61 6d 65 73 5b 72 5d 2c 69 3d 6e 28 73 2e 66 75 6e 63 29 3b 74 26 26 28 74 2b 3d 22 5c 6e 22 29 2c 69 26 26 28 74 2b 3d 69 2b 22 40 22 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 73 2e 75 72 6c 26 26 28 74 2b 3d 73 2e 75 72 6c 29 2c 73 2e 6c 69 6e 65 26 26 28 74 2b 3d 22 3a 22 2b 73 2e 6c 69 6e 65 29 7d 72 65 74 75 72 6e 20 74 7d 73 74 6f 72 65 45 72 72 6f 72 28 65 2c 74 2c 72 2c 73 29 7b 74 3d 74 7c 7c 28 30 2c 43 2e 7a 29 28 29 3b 63 6f 6e 73 74 20 6e 3d 28 30 2c 77 2e 4f 50 29 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 3b 6c 65 74 20 69 3b 69 66 28 21 72 26 26 6e 2e 6f 6e 65 72 72 6f 72 26 Data Ascii: t="",r=0;r<e.frames.length;r++){var s=e.frames[r],i=n(s.func);t&&(t+="\n"),i&&(t+=i+"@"),"string"==typeof s.url&&(t+=s.url),s.line&&(t+=":"+s.line)}return t}storeError(e,t,r,s){t=t\|\|(0,C.z)();const n=(0,w.OP)(this.agentIdentifier);let i;if(!r&&n.onerror&
2024-04-26 17:13:22 UTC	1221	IN	Data Raw: 74 69 6f 6e 49 64 5d 2e 70 75 73 68 28 5b 64 2c 75 2c 63 2c 6c 2c 6d 2c 73 5d 29 3b 65 6c 73 65 7b 76 61 72 20 67 3d 7b 7d 3b 28 30 2c 49 2e 44 29 28 6d 2c 6b 29 2c 73 26 26 28 30 2c 49 2e 44 29 28 73 2c 6b 29 3b 76 61 72 20 76 3d 75 2b 22 3a 22 2b 62 28 28 30 2c 48 2e 50 29 28 67 29 29 3b 74 68 69 73 2e 61 67 67 72 65 67 61 74 6f 72 2e 73 74 6f 72 65 28 64 2c 76 2c 63 2c 6c 2c 67 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 65 2c 74 29 7b 67 5b 65 5d 3d 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 3f 28 30 2c 48 2e 50 29 28 74 29 3a 74 7d 7d 6f 6e 49 6e 74 65 72 61 63 74 69 6f 6e 53 61 76 65 64 28 65 29 7b 74 68 69 73 2e 65 72 72 6f 72 43 61 63 68 65 5b 65 2e 69 64 5d 26 26 21 74 68 69 73 2e 62 6c 6f 63 6b 65 64 26 26 28 74 68 69 73 2e 65 Data Ascii: tionId].push([d,u,c,l,m,s]);else{var g={};(0,I.D)(m,k),s&&(0,I.D)(s,k);var v=u+":"+b((0,H.P)(g));this.aggregator.store(d,v,c,l,g)}}function k(e,t){g[e]=t&&"object"==typeof t?(0,H.P)(t):t}}onInteractionSaved(e){this.errorCache[e.id]&&!this.blocked&&(this.e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49989	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:21 UTC	566	OUT	GET /page_view_event-aggregate.06482edd-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	814	IN	HTTP/1.1 200 OK Connection: close Content-Length: 10978 x-amz-id-2: cpqRvVAJ98U91m3f06GATeaGhtCNR3QV9TCm9RagE4FCXFbDZZimuilN5x7MbhWyXKNAmmoScJyEuCR/bM0WXw== x-amz-request-id: W4Q6GM7WEDA3QNGQ Last-Modified: Wed, 18 Oct 2023 21:34:30 GMT ETag: "553d27144d4f9fbe7e31b802107a2071" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: hzDCTq4MMt37av6rZrMy6pZ_grMxVGC2 Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760082-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 38 36 5d 2c 7b 37 37 37 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 64 28 74 2c 7b 65 3a 28 29 3d 3e 72 7d 29 3b 63 6f 6e 73 74 20 72 3d 7b 7d 7d 2c 35 39 39 38 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 64 28 74 2c 7b 75 42 3a 28 29 3d 3e 68 2c 77 75 3a 28 29 3d 3e 6c 2c 7a 4a 3a 28 29 3d 3e 6d 7d 29 3b 76 61 72 20 72 3d 22 53 74 61 72 74 22 2c 69 3d 22 45 6e 64 22 2c 61 3d 22 75 6e 6c 6f 61 64 45 76 65 6e 74 22 2c 6f 3d 22 72 65 64 69 72 65 63 74 22 2c 73 3d 22 64 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 22 2c 75 3d 22 6f 6e 6e 65 63 74 22 2c 63 3d Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[786],{777:(e,t,n)=>{n.d(t,{e:()=>r});const r={}},5998:(e,t,n)=>{n.d(t,{uB:()=>h,wu:()=>l,zJ:()=>m});var r="Start",i="End",a="unloadEvent",o="redirect",s="domainLookup",u="onnect",c=
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 74 20 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 6e 65 77 72 65 6c 69 63 2e 69 6e 69 74 69 61 6c 69 7a 65 64 41 67 65 6e 74 73 5b 65 5d 2e 66 65 61 74 75 72 65 73 29 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 20 69 2e 44 2e 61 6a 61 78 3a 74 2e 70 75 73 68 28 22 78 68 72 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 69 2e 44 2e 6a 73 65 72 72 6f 72 73 3a 74 2e 70 75 73 68 28 22 65 72 72 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 69 2e 44 2e 70 61 67 65 41 63 74 69 6f 6e 3a 74 2e 70 75 73 68 28 22 69 6e 73 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 69 2e 44 2e 73 65 73 73 69 6f 6e 54 72 61 63 65 3a 74 2e 70 75 73 68 28 22 73 74 6e 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 69 2e 44 2e 73 70 61 Data Ascii: t t=[];return Object.keys(newrelic.initializedAgents[e].features).forEach((e=>{switch(e){case i.D.ajax:t.push("xhr");break;case i.D.jserrors:t.push("err");break;case i.D.pageAction:t.push("ins");break;case i.D.sessionTrace:t.push("stn");break;case i.D.spa
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 67 72 65 67 61 74 6f 72 2e 73 74 6f 72 65 28 22 6d 65 61 73 75 72 65 73 22 2c 22 64 63 22 2c 7b 76 61 6c 75 65 3a 61 2e 69 6c 3f 74 5b 70 2e 71 77 5d 3a 30 7d 29 3b 63 6f 6e 73 74 20 72 3d 7b 74 74 3a 65 2e 74 74 47 75 69 64 2c 75 73 3a 65 2e 75 73 65 72 2c 61 63 3a 65 2e 61 63 63 6f 75 6e 74 2c 70 72 3a 65 2e 70 72 6f 64 75 63 74 2c 61 66 3a 6d 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 2e 6a 6f 69 6e 28 22 2c 22 29 2c 2e 2e 2e 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 28 74 68 69 73 2e 61 67 67 72 65 67 61 74 6f 72 2e 67 65 74 28 22 6d 65 61 73 75 72 65 73 22 29 7c 7c 7b 7d 29 2e 72 65 64 75 63 65 28 28 28 65 2c 74 29 3d 3e 7b 6c 65 74 5b 6e 2c 72 5d 3d 74 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 72 2e 70 61 72 61 6d 73 3f 2e 76 61 Data Ascii: gregator.store("measures","dc",{value:a.il?t[p.qw]:0});const r={tt:e.ttGuid,us:e.user,ac:e.account,pr:e.product,af:m(this.agentIdentifier).join(","),...Object.entries(this.aggregator.get("measures")\|\|{}).reduce(((e,t)=>{let[n,r]=t;return e[n]=r.params?.va
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 5a 29 28 22 52 55 4d 20 63 61 6c 6c 20 66 61 69 6c 65 64 2e 20 41 67 65 6e 74 20 73 68 75 74 74 69 6e 67 20 64 6f 77 6e 2e 22 29 7d 7d 7d 29 7d 7d 7d 2c 38 30 38 35 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 64 28 74 2c 7b 46 75 3a 28 29 3d 3e 52 2c 4e 4f 3a 28 29 3d 3e 58 2c 59 6e 3a 28 29 3d 3e 4b 2c 61 34 3a 28 29 3d 3e 4c 2c 6d 72 3a 28 29 3d 3e 74 65 2c 6d 77 3a 28 29 3d 3e 6b 7d 29 3b 76 61 72 20 72 2c 69 2c 61 2c 6f 2c 73 2c 75 3d 2d 31 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 61 67 65 73 68 6f 77 22 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 70 65 72 73 69 73 74 65 64 26 26 28 75 3d 74 2e 74 69 6d 65 53 74 61 6d 70 2c 65 28 74 29 29 7d 29 2c 21 30 29 7d 2c 66 3d 66 75 6e 63 74 69 6f 6e Data Ascii: Z)("RUM call failed. Agent shutting down.")}}})}}},8085:(e,t,n)=>{n.d(t,{Fu:()=>R,NO:()=>X,Yn:()=>K,a4:()=>L,mr:()=>te,mw:()=>k});var r,i,a,o,s,u=-1,c=function(e){addEventListener("pageshow",(function(t){t.persisted&&(u=t.timeStamp,e(t))}),!0)},f=function
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 70 61 67 65 68 69 64 65 22 21 3d 3d 74 2e 74 79 70 65 26 26 22 68 69 64 64 65 6e 22 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 7c 7c 65 28 74 29 7d 3b 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 74 2c 21 30 29 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 61 67 65 68 69 64 65 22 2c 74 2c 21 30 29 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 21 31 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 7c 7c 28 65 28 6e 29 2c 74 3d 21 30 29 7d 7d 2c 79 3d 2d 31 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 68 69 64 64 65 6e 22 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 Data Ascii: pagehide"!==t.type&&"hidden"!==document.visibilityState\|\|e(t)};addEventListener("visibilitychange",t,!0),addEventListener("pagehide",t,!0)},g=function(e){var t=!1;return function(n){t\|\|(e(n),t=!0)}},y=-1,T=function(){return"hidden"!==document.visibilitySt
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 68 61 64 52 65 63 65 6e 74 49 6e 70 75 74 29 7b 76 61 72 20 74 3d 61 5b 30 5d 2c 6e 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 69 26 26 65 2e 73 74 61 72 74 54 69 6d 65 2d 6e 2e 73 74 61 72 74 54 69 6d 65 3c 31 65 33 26 26 65 2e 73 74 61 72 74 54 69 6d 65 2d 74 2e 73 74 61 72 74 54 69 6d 65 3c 35 65 33 3f 28 69 2b 3d 65 2e 76 61 6c 75 65 2c 61 2e 70 75 73 68 28 65 29 29 3a 28 69 3d 65 2e 76 61 6c 75 65 2c 61 3d 5b 65 5d 29 7d 7d 29 29 2c 69 3e 72 2e 76 61 6c 75 65 26 26 28 72 2e 76 61 6c 75 65 3d 69 2c 72 2e 65 6e 74 72 69 65 73 3d 61 2c 6e 28 29 29 7d 2c 73 3d 6d 28 22 6c 61 79 6f 75 74 2d 73 68 69 66 74 22 2c 6f 29 3b 73 26 26 28 6e 3d 6c 28 65 2c 72 2c 4d 2c 74 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 Data Ascii: tion(e){if(!e.hadRecentInput){var t=a[0],n=a[a.length-1];i&&e.startTime-n.startTime<1e3&&e.startTime-t.startTime<5e3?(i+=e.value,a.push(e)):(i=e.value,a=[e])}})),i>r.value&&(r.value=i,r.entries=a,n())},s=m("layout-shift",o);s&&(n=l(e,r,M,t.reportAllChange
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 28 65 29 7b 65 2e 66 6f 72 45 61 63 68 28 75 29 7d 2c 64 3d 6d 28 22 66 69 72 73 74 2d 69 6e 70 75 74 22 2c 66 29 3b 6e 3d 6c 28 65 2c 73 2c 4f 2c 74 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 2c 64 26 26 76 28 67 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 28 64 2e 74 61 6b 65 52 65 63 6f 72 64 73 28 29 29 2c 64 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 7d 29 29 29 2c 64 26 26 63 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3b 73 3d 70 28 22 46 49 44 22 29 2c 6e 3d 6c 28 65 2c 73 2c 4f 2c 74 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 2c 6f 3d 5b 5d 2c 69 3d 2d 31 2c 72 3d 6e 75 6c 6c 2c 42 28 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 2c 61 3d 75 2c 6f 2e 70 75 73 68 28 61 29 2c 44 28 29 7d 29 29 7d 29 29 7d 2c 4e 3d 30 Data Ascii: (e){e.forEach(u)},d=m("first-input",f);n=l(e,s,O,t.reportAllChanges),d&&v(g((function(){f(d.takeRecords()),d.disconnect()}))),d&&c((function(){var a;s=p("FID"),n=l(e,s,O,t.reportAllChanges),o=[],i=-1,r=null,B(addEventListener),a=u,o.push(a),D()}))}))},N=0
2024-04-26 17:13:22 UTC	1332	IN	Data Raw: 61 3d 6d 28 22 65 76 65 6e 74 22 2c 69 2c 7b 64 75 72 61 74 69 6f 6e 54 68 72 65 73 68 6f 6c 64 3a 74 2e 64 75 72 61 74 69 6f 6e 54 68 72 65 73 68 6f 6c 64 7c 7c 34 30 7d 29 3b 6e 3d 6c 28 65 2c 72 2c 4a 2c 74 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 2c 61 26 26 28 61 2e 6f 62 73 65 72 76 65 28 7b 74 79 70 65 3a 22 66 69 72 73 74 2d 69 6e 70 75 74 22 2c 62 75 66 66 65 72 65 64 3a 21 30 7d 29 2c 76 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 61 2e 74 61 6b 65 52 65 63 6f 72 64 73 28 29 29 2c 72 2e 76 61 6c 75 65 3c 30 26 26 55 28 29 3e 30 26 26 28 72 2e 76 61 6c 75 65 3d 30 2c 72 2e 65 6e 74 72 69 65 73 3d 5b 5d 29 2c 6e 28 21 30 29 7d 29 29 2c 63 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 56 3d 5b 5d 2c 47 3d 7a 28 29 2c 72 3d 70 28 22 49 4e 50 Data Ascii: a=m("event",i,{durationThreshold:t.durationThreshold\|\|40});n=l(e,r,J,t.reportAllChanges),a&&(a.observe({type:"first-input",buffered:!0}),v((function(){i(a.takeRecords()),r.value<0&&U()>0&&(r.value=0,r.entries=[]),n(!0)})),c((function(){V=[],G=z(),r=p("INP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49985	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:21 UTC	558	OUT	GET /metrics-aggregate.3dc53903-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	821	IN	HTTP/1.1 200 OK Connection: close Content-Length: 8471 x-amz-id-2: 6lmJGT2HcMzyJuyjz/dT67OMC2TKlGvgMJ/e52xXtSdL9jN9/+sEYVppkWHskTWB6HMaNQyZc4Q8Iu0rHF/y+xVLzrOjXIuE x-amz-request-id: W4Q3SKY0D0J65EVA Last-Modified: Wed, 18 Oct 2023 20:58:39 GMT ETag: "a912f1cb80b2d3cf15f10d9d022b6188" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: Zd7iRh_nyGT5Jl7yYIBZG_dRIUpKHO9i Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760094-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 34 37 5d 2c 7b 32 35 37 33 3a 28 74 2c 65 2c 73 29 3d 3e 7b 73 2e 64 28 65 2c 7b 6f 3a 28 29 3d 3e 68 7d 29 3b 76 61 72 20 72 3d 73 28 34 32 34 37 29 2c 6f 3d 73 28 31 31 31 37 29 2c 69 3d 73 28 38 36 37 33 29 2c 6e 3d 73 28 38 33 31 30 29 2c 61 3d 73 28 35 37 36 33 29 2c 63 3d 73 28 33 38 36 30 29 3b 63 6c 61 73 73 20 68 20 65 78 74 65 6e 64 73 20 6f 2e 77 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 2c 65 2c 73 29 7b 73 75 70 65 72 28 73 29 2c 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 3d 74 2c 74 68 69 73 2e 6f 70 74 73 3d 65 7c 7c 7b 7d Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[147],{2573:(t,e,s)=>{s.d(e,{o:()=>h});var r=s(4247),o=s(1117),i=s(8673),n=s(8310),a=s(5763),c=s(3860);class h extends o.w{constructor(t,e,s){super(s),this.endpoint=t,this.opts=e\|\|{}
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 6f 29 3f 6f 3a 5b 6f 5d 2c 69 2e 70 75 73 68 28 2e 2e 2e 6f 29 7d 6c 65 74 20 6e 3d 74 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 58 28 74 29 3b 69 2e 6c 65 6e 67 74 68 3f 6e 3d 74 68 69 73 2e 6f 70 74 73 2e 72 61 77 3f 74 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 5f 73 65 6e 64 28 74 29 3a 74 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 28 74 29 3a 69 2e 70 75 73 68 28 76 6f 69 64 20 30 29 2c 69 2e 66 6f 72 45 61 63 68 28 28 72 3d 3e 7b 6e 28 7b 65 6e 64 70 6f 69 6e 74 3a 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 2c 70 61 79 6c 6f 61 64 3a 72 2c 6f 70 74 73 3a 74 2c 73 75 62 6d 69 74 4d 65 74 68 6f 64 3a 73 2c 63 62 46 69 6e 69 73 68 65 64 3a 65 2c 63 75 73 74 6f 6d 55 72 Data Ascii: type.toString.call(o)?o:[o],i.push(...o)}let n=t=>this.harvest.sendX(t);i.length?n=this.opts.raw?t=>this.harvest._send(t):t=>this.harvest.send(t):i.push(void 0),i.forEach((r=>{n({endpoint:this.endpoint,payload:r,opts:t,submitMethod:s,cbFinished:e,customUr
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 77 69 6e 64 6f 77 2c 22 52 65 61 63 74 44 4f 4d 22 29 7c 7c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 77 69 6e 64 6f 77 2c 22 52 65 61 63 74 52 65 64 75 78 22 29 7c 7c 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 5b 64 61 74 61 2d 72 65 61 63 74 72 6f 6f 74 5d 2c 20 5b 64 61 74 61 2d 72 65 61 63 74 69 64 5d 22 29 7c 7c 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 62 6f 64 79 20 3e 20 64 69 76 22 29 3b 66 6f 72 28 6c 65 74 20 65 3d 30 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 69 66 28 4f 62 6a 65 Data Ascii: ototype.hasOwnProperty.call(window,"ReactDOM")\|\|Object.prototype.hasOwnProperty.call(window,"ReactRedux")\|\|document.querySelector("[data-reactroot], [data-reactid]")\|\|(()=>{const t=document.querySelectorAll("body > div");for(let e=0;e<t.length;e++)if(Obje
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 4d 3d 22 46 75 6e 63 74 69 6f 6e 2e 63 61 6c 6c 22 2c 6a 3d 22 41 72 72 61 79 2e 69 6e 63 6c 75 64 65 73 22 2c 50 3d 22 41 72 72 61 79 2e 66 72 6f 6d 22 2c 6b 3d 22 41 72 72 61 79 2e 66 69 6e 64 22 2c 41 3d 22 41 72 72 61 79 2e 66 6c 61 74 22 2c 48 3d 22 41 72 72 61 79 2e 66 6c 61 74 4d 61 70 22 2c 45 3d 22 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 22 2c 52 3d 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 46 3d 22 4f 62 6a 65 63 74 2e 76 61 6c 75 65 73 22 2c 54 3d 22 4d 61 70 22 2c 78 3d 22 53 65 74 22 2c 43 3d 22 57 65 61 6b 4d 61 70 22 2c 44 3d 22 57 65 61 6b 53 65 74 22 3b 76 61 72 20 4e 3d 73 28 32 32 37 31 29 2c 42 3d 73 28 36 31 34 31 29 2c 47 3d 73 28 36 38 31 38 29 2c 49 3d 73 28 33 39 36 30 29 2c 71 3d 73 28 33 32 33 39 29 2c 5f 3d 73 28 32 32 Data Ascii: M="Function.call",j="Array.includes",P="Array.from",k="Array.find",A="Array.flat",H="Array.flatMap",E="Object.assign",R="Object.entries",F="Object.values",T="Map",x="Set",C="WeakMap",D="WeakSet";var N=s(2271),B=s(6141),G=s(6818),I=s(3960),q=s(3239),_=s(22
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 69 6c 69 74 79 4d 65 74 72 69 63 73 28 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 22 2e 63 6f 6e 63 61 74 28 74 2c 22 2f 44 65 74 65 63 74 65 64 22 29 29 2c 63 2e 69 6c 26 26 28 30 2c 49 2e 4b 29 28 28 28 29 3d 3e 7b 77 28 29 2e 66 6f 72 45 61 63 68 28 28 74 3d 3e 7b 74 68 69 73 2e 73 74 6f 72 65 53 75 70 70 6f 72 74 61 62 69 6c 69 74 79 4d 65 74 72 69 63 73 28 22 46 72 61 6d 65 77 6f 72 6b 2f 22 2b 74 2b 22 2f 44 65 74 65 63 74 65 64 22 29 7d 29 29 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 74 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 74 72 79 7b 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 2e 62 69 6e 64 7c 7c 6d 2e 74 65 73 74 28 65 2e 62 69 6e 64 2e 74 6f 53 74 72 69 6e 67 28 29 29 7c Data Ascii: ilityMetrics("Generic/DistMethod/".concat(t,"/Detected")),c.il&&(0,I.K)((()=>{w().forEach((t=>{this.storeSupportabilityMetrics("Framework/"+t+"/Detected")}))})),function(){const t=[],e=function(){};try{"function"!=typeof e.bind\|\|m.test(e.bind.toString())\|
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 65 50 72 6f 74 6f 63 6f 6c 2f 44 65 74 65 63 74 65 64 22 29 3b 63 6f 6e 73 74 20 73 3d 28 30 2c 42 2e 24 63 29 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 3b 73 2e 6c 65 6e 67 74 68 3e 30 26 26 74 68 69 73 2e 73 74 6f 72 65 53 75 70 70 6f 72 74 61 62 69 6c 69 74 79 4d 65 74 72 69 63 73 28 22 47 65 6e 65 72 69 63 2f 4f 62 66 75 73 63 61 74 65 2f 44 65 74 65 63 74 65 64 22 29 2c 73 2e 6c 65 6e 67 74 68 3e 30 26 26 21 28 30 2c 42 2e 4e 67 29 28 73 29 26 26 74 68 69 73 2e 73 74 6f 72 65 53 75 70 70 6f 72 74 61 62 69 6c 69 74 79 4d 65 74 72 69 63 73 28 22 47 65 6e 65 72 69 63 2f 4f 62 66 75 73 63 61 74 65 2f 49 6e 76 61 6c 69 64 22 29 7d 65 61 63 68 53 65 73 73 69 6f 6e 43 68 65 63 6b 73 28 29 7b 63 2e 69 6c 26 26 28 30 2c 71 2e 62 50 29 Data Ascii: eProtocol/Detected");const s=(0,B.$c)(this.agentIdentifier);s.length>0&&this.storeSupportabilityMetrics("Generic/Obfuscate/Detected"),s.length>0&&!(0,B.Ng)(s)&&this.storeSupportabilityMetrics("Generic/Obfuscate/Invalid")}eachSessionChecks(){c.il&&(0,q.bP)
2024-04-26 17:13:22 UTC	203	IN	Data Raw: 61 74 75 72 65 2f 53 65 73 73 69 6f 6e 54 72 61 63 65 2f 44 75 72 61 74 69 6f 6e 4d 73 22 2c 4d 61 74 68 2e 72 6f 75 6e 64 28 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 29 29 3b 63 6f 6e 73 74 20 6e 3d 28 30 2c 57 2e 50 29 28 65 2e 6a 73 41 74 74 72 69 62 75 74 65 73 29 3b 74 68 69 73 2e 73 74 6f 72 65 53 75 70 70 6f 72 74 61 62 69 6c 69 74 79 4d 65 74 72 69 63 73 28 22 50 61 67 65 53 65 73 73 69 6f 6e 2f 46 65 61 74 75 72 65 2f 43 75 73 74 6f 6d 44 61 74 61 2f 42 79 74 65 73 22 2c 22 7b 7d 22 3d 3d 3d 6e 3f 30 3a 6e 2e 6c 65 6e 67 74 68 29 7d 63 61 74 63 68 28 61 29 7b 7d 7d 7d 7d 7d 5d 29 3b Data Ascii: ature/SessionTrace/DurationMs",Math.round(performance.now()));const n=(0,W.P)(e.jsAttributes);this.storeSupportabilityMetrics("PageSession/Feature/CustomData/Bytes","{}"===n?0:n.length)}catch(a){}}}}}]);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49984	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:21 UTC	993	OUT	GET /track/upb/?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347
2024-04-26 17:13:22 UTC	533	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:22 GMT Content-Type: text/html Content-Length: 947 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:22 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwjE0cDWxofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUoAzILCIiQw4Pdh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB; expires=Sat, 26 Apr 2025 17:13:22 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:22 UTC	947	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 61 64 73 72 76 72 2e 6f 72 67 2f 75 6e 69 76 65 72 73 61 6c 5f 70 69 78 65 6c 2e 31 2e 31 2e 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 75 6e 69 76 65 72 73 61 6c 50 69 78 65 6c 43 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 6c 6f 62 61 6c 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <html><head> <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script></head><body> <div id="universalPixelContainer"> <script type="text/javascript"> (function(global) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49986	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:21 UTC	555	OUT	GET /ajax-aggregate.998ef92b-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	813	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7044 x-amz-id-2: NaZXLKT2+qYilVsdAH1XjxUW3eOvBuLrvTPuvqg60TIx9LRZBP+SqZfgjs6HrxxOO+TnAK8eawMOouqSotUc5g== x-amz-request-id: W4Q45KJPDJEBW4NW Last-Modified: Wed, 18 Oct 2023 20:57:29 GMT ETag: "07e3c83179c7da2e2f464a72b084aacf" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: 4RFYRqAfNJzZv3o_5YXaoBJ6WgEOM5as Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760085-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 39 38 5d 2c 7b 31 31 39 39 3a 28 74 2c 65 2c 73 29 3d 3e 7b 73 2e 64 28 65 2c 7b 52 3a 28 29 3d 3e 61 2c 7a 3a 28 29 3d 3e 69 7d 29 3b 76 61 72 20 6e 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 69 66 28 30 3d 3d 3d 6e 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 30 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 74 2e 68 6f 73 74 6e 61 6d 65 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 6e 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 73 3d 6e 5b 65 5d 3b 69 66 28 22 2a 22 3d 3d 3d 73 2e 68 6f 73 74 6e Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[898],{1199:(t,e,s)=>{s.d(e,{R:()=>a,z:()=>i});var n=[];function i(t){if(0===n.length)return!0;if(void 0===t.hostname)return!1;for(var e=0;e<n.length;e++){var s=n[e];if("*"===s.hostn
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 65 72 76 61 6c 3d 74 2c 74 68 69 73 2e 73 74 61 72 74 65 64 3d 21 30 2c 74 68 69 73 2e 73 63 68 65 64 75 6c 65 48 61 72 76 65 73 74 28 6e 75 6c 6c 21 3d 65 3f 65 3a 74 68 69 73 2e 69 6e 74 65 72 76 61 6c 29 7d 73 74 6f 70 54 69 6d 65 72 28 29 7b 6c 65 74 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3b 74 68 69 73 2e 61 62 6f 72 74 65 64 3d 74 2c 74 68 69 73 2e 73 74 61 72 74 65 64 3d 21 31 2c 74 68 69 73 2e 74 69 6d 65 6f 75 74 48 61 6e 64 6c 65 26 26 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 74 69 6d 65 6f 75 74 48 61 6e 64 6c 65 29 7d 73 63 68 65 64 75 6c 65 48 61 72 76 65 73 74 28 74 2c 65 29 7b 74 68 69 73 2e 74 Data Ascii: erval=t,this.started=!0,this.scheduleHarvest(null!=e?e:this.interval)}stopTimer(){let t=arguments.length>0&&void 0!==arguments[0]&&arguments[0];this.aborted=t,this.started=!1,this.timeoutHandle&&clearTimeout(this.timeoutHandle)}scheduleHarvest(t,e){this.t
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 58 3a 28 29 3d 3e 75 2c 6e 31 3a 28 29 3d 3e 6c 2c 75 52 3a 28 29 3d 3e 64 7d 29 3b 76 61 72 20 6e 3d 73 28 31 32 38 34 29 2c 69 3d 73 28 34 33 35 31 29 2c 61 3d 73 28 36 31 34 31 29 2c 72 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6f 3d 36 34 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 65 2c 73 29 7b 72 65 74 75 72 6e 20 74 7c 7c 30 3d 3d 3d 74 7c 7c 22 22 3d 3d 3d 74 3f 65 28 74 29 2b 28 73 3f 22 2c 22 3a 22 22 29 3a 22 21 22 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 65 3f 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 3a 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 30 3d 3d 3d 74 3f 22 22 3a 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 29 2e 74 6f 53 74 72 Data Ascii: X:()=>u,n1:()=>l,uR:()=>d});var n=s(1284),i=s(4351),a=s(6141),r=Object.prototype.hasOwnProperty,o=64;function h(t,e,s){return t\|\|0===t\|\|""===t?e(t)+(s?",":""):"!"}function d(t,e){return e?Math.floor(t).toString(36):void 0===t\|\|0===t?"":Math.floor(t).toStr
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 6f 3d 73 28 35 37 36 33 29 2c 68 3d 73 28 32 35 37 33 29 2c 64 3d 73 28 31 31 39 39 29 2c 75 3d 73 28 37 38 32 35 29 2c 6c 3d 73 28 38 65 33 29 2c 63 3d 73 28 33 33 32 35 29 2c 70 3d 73 28 33 30 38 31 29 2c 66 3d 73 28 32 32 32 32 29 3b 63 6c 61 73 73 20 76 20 65 78 74 65 6e 64 73 20 66 2e 6d 7b 73 74 61 74 69 63 20 66 65 61 74 75 72 65 4e 61 6d 65 3d 75 2e 74 3b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 2c 65 29 7b 73 75 70 65 72 28 74 2c 65 2c 75 2e 74 29 3b 6c 65 74 20 73 2c 66 3d 5b 5d 2c 76 3d 7b 7d 2c 67 3d 5b 5d 3b 63 6f 6e 73 74 20 6d 3d 74 68 69 73 2e 65 65 2c 62 3d 28 30 2c 6f 2e 4d 74 29 28 74 2c 22 61 6a 61 78 2e 68 61 72 76 65 73 74 54 69 6d 65 53 65 63 6f 6e 64 73 22 29 7c 7c 31 30 2c 78 3d 28 30 2c 6f 2e 4d 74 29 28 74 2c 22 61 6a 61 78 2e 6d Data Ascii: o=s(5763),h=s(2573),d=s(1199),u=s(7825),l=s(8e3),c=s(3325),p=s(3081),f=s(2222);class v extends f.m{static featureName=u.t;constructor(t,e){super(t,e,u.t);let s,f=[],v={},g=[];const m=this.ee,b=(0,o.Mt)(t,"ajax.harvestTimeSeconds")\|\|10,x=(0,o.Mt)(t,"ajax.m
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 66 28 6f 2e 74 6f 6f 42 69 67 28 65 29 29 7b 69 66 28 31 21 3d 3d 6f 2e 65 76 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7b 61 3d 21 30 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 6e 2e 70 75 73 68 28 6f 2e 70 61 79 6c 6f 61 64 29 7d 72 65 74 75 72 6e 20 61 3f 48 28 74 2c 65 2c 2b 2b 73 29 3a 6e 7d 66 75 6e 63 74 69 6f 6e 20 41 28 65 29 7b 74 68 69 73 2e 61 64 64 53 74 72 69 6e 67 3d 28 30 2c 61 2e 46 58 29 28 74 29 2c 74 68 69 73 2e 65 76 65 6e 74 73 3d 65 2c 74 68 69 73 2e 70 61 79 6c 6f 61 64 3d 22 62 65 6c 2e 37 3b 22 3b 66 6f 72 28 76 61 72 20 73 3d 30 3b 73 3c 65 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 7b 76 61 72 20 6e 3d 65 5b 73 5d 2c 69 3d 5b 28 30 2c 61 2e 75 52 29 28 6e 2e 73 74 61 72 74 54 69 6d 65 29 2c 28 30 2c 61 2e 75 52 29 28 6e 2e 65 6e 64 54 69 6d 65 Data Ascii: f(o.tooBig(e)){if(1!==o.events.length){a=!0;break}}else n.push(o.payload)}return a?H(t,e,++s):n}function A(e){this.addString=(0,a.FX)(t),this.events=e,this.payload="bel.7;";for(var s=0;s<e.length;s++){var n=e[s],i=[(0,a.uR)(n.startTime),(0,a.uR)(n.endTime
2024-04-26 17:13:22 UTC	154	IN	Data Raw: 28 74 68 69 73 2e 66 65 61 74 75 72 65 4e 61 6d 65 29 2c 28 28 29 3d 3e 7b 73 2e 73 74 61 72 74 54 69 6d 65 72 28 62 29 7d 29 29 29 2c 28 30 2c 6c 2e 4c 29 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 2c 74 68 69 73 2e 66 65 61 74 75 72 65 4e 61 6d 65 29 7d 7d 7d 2c 37 38 32 35 3a 28 74 2c 65 2c 73 29 3d 3e 7b 73 2e 64 28 65 2c 7b 74 3a 28 29 3d 3e 6e 7d 29 3b 63 6f 6e 73 74 20 6e 3d 73 28 33 33 32 35 29 2e 44 2e 61 6a 61 78 7d 7d 5d 29 3b Data Ascii: (this.featureName),(()=>{s.startTimer(b)}))),(0,l.L)(this.agentIdentifier,this.featureName)}}},7825:(t,e,s)=>{s.d(e,{t:()=>n});const n=s(3325).D.ajax}}]);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49991	54.165.219.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	600	OUT	POST /messenger/web/metrics HTTP/1.1 Host: api-iam.intercom.io Connection: keep-alive Content-Length: 941 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	941	OUT	Data Raw: 61 70 70 5f 69 64 3d 62 74 64 6e 36 36 76 34 26 76 3d 33 26 67 3d 35 61 35 31 39 32 36 66 30 37 35 35 62 37 63 62 63 39 34 33 30 63 64 36 62 38 34 61 33 33 62 32 31 66 65 61 35 64 37 66 26 73 3d 30 39 33 65 64 65 36 37 2d 36 64 62 36 2d 34 38 36 65 2d 61 63 36 62 2d 36 63 30 31 65 39 34 64 64 39 34 62 26 72 3d 26 70 6c 61 74 66 6f 72 6d 3d 77 65 62 26 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 5f 74 79 70 65 3d 6a 73 2d 73 6e 69 70 70 65 74 26 49 64 65 6d 70 6f 74 65 6e 63 79 2d 4b 65 79 3d 63 32 33 32 30 34 30 33 36 32 66 31 32 39 65 33 26 69 6e 74 65 72 6e 61 6c 3d 26 69 73 5f 69 6e 74 65 72 73 65 63 74 69 6f 6e 5f 62 6f 6f 74 65 64 3d 6e 75 6c 6c 26 70 61 67 65 5f 74 69 74 6c 65 3d 49 6e 76 6f 69 63 65 25 32 30 35 36 35 37 36 25 32 30 2d 25 32 30 4c 69 7a 7a Data Ascii: app_id=btdn66v4&v=3&g=5a51926f0755b7cbc9430cd6b84a33b21fea5d7f&s=093ede67-6db6-486e-ac6b-6c01e94dd94b&r=&platform=web&installation_type=js-snippet&Idempotency-Key=c232040362f129e3&internal=&is_intersection_booted=null&page_title=Invoice%2056576%20-%20Lizz
2024-04-26 17:13:22 UTC	862	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Status: 200 OK Cache-Control: no-cache Access-Control-Allow-Origin: https://in.xero.com Vary: Accept-Encoding Strict-Transport-Security: max-age=31556952; includeSubDomains; preload Access-Control-Expose-Headers: x-request-id X-Intercom-Version: e64aea2276c5131ea3a8490f307bc11a91aecc29 X-XSS-Protection: 1; mode=block X-Request-Queueing: 0 X-Request-Id: 002u21qiebciesa7q4sg Access-Control-Allow-Headers: Content-Type, Idempotency-Key, X-INTERCOM-APP, X-INTERCOM-PAGE-TITLE, X-INTERCOM-USER-DATA Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS X-Runtime: 0.024919 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Server: nginx x-ami-version: ami-07f0efd8322b9d369
2024-04-26 17:13:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49993	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	1159	OUT	POST /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=23183&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/&af=err,xhr,stn,ins,spa&be=923&fe=19419&dc=4715&perf=%7B%22timing%22:%7B%22of%22:1714151578018,%22n%22:0,%22r%22:3,%22re%22:740,%22f%22:740,%22dn%22:740,%22dne%22:740,%22c%22:740,%22s%22:740,%22ce%22:740,%22rq%22:741,%22rp%22:923,%22rpe%22:3428,%22di%22:4527,%22ds%22:5638,%22de%22:5638,%22dc%22:20330,%22l%22:20331,%22le%22:20342%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=3405&fcp=3405 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 28 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:22 UTC	28	OUT	Data Raw: 7b 22 6a 61 22 3a 7b 22 73 69 74 65 56 65 72 73 69 6f 6e 22 3a 22 6e 65 77 22 7d 7d Data Ascii: {"ja":{"siteVersion":"new"}}
2024-04-26 17:13:22 UTC	436	IN	HTTP/1.1 200 Connection: close Content-Length: 151 date: Fri, 26 Apr 2024 17:13:22 GMT content-type: text/plain cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com access-control-expose-headers: Date timing-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760077-MIA
2024-04-26 17:13:22 UTC	151	IN	Data Raw: 7b 22 73 74 6e 22 3a 30 2c 22 65 72 72 22 3a 31 2c 22 69 6e 73 22 3a 31 2c 22 73 70 61 22 3a 31 2c 22 73 72 22 3a 30 2c 22 73 72 73 22 3a 30 2c 22 73 74 22 3a 30 2c 22 73 74 73 22 3a 30 2c 22 61 70 70 22 3a 7b 22 61 67 65 6e 74 73 22 3a 5b 7b 22 65 6e 74 69 74 79 47 75 69 64 22 3a 22 4d 54 6b 32 4d 6a 41 78 4e 33 78 43 55 6b 39 58 55 30 56 53 66 45 46 51 55 45 78 4a 51 30 46 55 53 55 39 4f 66 44 45 77 4d 6a 4d 7a 4f 44 55 78 4e 6a 41 22 7d 5d 7d 7d Data Ascii: {"stn":0,"err":1,"ins":1,"spa":1,"sr":0,"srs":0,"st":0,"sts":0,"app":{"agents":[{"entityGuid":"MTk2MjAxN3xCUk9XU0VSfEFQUExJQ0FUSU9OfDEwMjMzODUxNjA"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49994	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	564	OUT	GET /session_trace-aggregate.83105561-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	802	IN	HTTP/1.1 200 OK Connection: close Content-Length: 12146 x-amz-id-2: 18Axvp0chbsTLa6UUVY2zrbeypJ5ZkIWxIVnNF9g1ym7fcju7mw+u4P8scXpvA+jN1mN+QEFYq4= x-amz-request-id: W4Q10SVGPNY5WJMR Last-Modified: Wed, 18 Oct 2023 21:36:06 GMT ETag: "4ef8d054860549421e884b3d2d74b83e" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: i7FiQ4ZQq6WkusXBROeoFJl9n3Tv0mKC Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760046-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 33 33 5d 2c 7b 39 31 33 39 3a 28 65 2c 74 2c 73 29 3d 3e 7b 6c 65 74 20 72 3b 73 2e 64 28 74 2c 7b 6d 3a 28 29 3d 3e 6e 7d 29 3b 63 6f 6e 73 74 20 69 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 65 3d 3e 72 3d 65 29 29 2c 6e 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 6f 6e 52 65 70 6c 61 79 52 65 61 64 79 3a 72 2c 73 65 73 73 69 6f 6e 52 65 70 6c 61 79 49 6e 69 74 69 61 6c 69 7a 65 64 3a 69 7d 29 7d 2c 32 35 37 33 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 6f 3a 28 29 3d 3e 63 7d 29 3b 76 61 72 20 72 3d 73 28 34 32 34 37 Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[733],{9139:(e,t,s)=>{let r;s.d(t,{m:()=>n});const i=new Promise((e=>r=e)),n=Object.freeze({onReplayReady:r,sessionReplayInitialized:i})},2573:(e,t,s)=>{s.d(t,{o:()=>c});var r=s(4247
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 3d 3d 3d 72 2e 42 65 3b 69 66 28 69 3d 74 68 69 73 2e 6f 70 74 73 2e 67 65 74 50 61 79 6c 6f 61 64 28 7b 72 65 74 72 79 3a 74 7d 29 2c 21 69 29 72 65 74 75 72 6e 20 76 6f 69 64 28 74 68 69 73 2e 73 74 61 72 74 65 64 26 26 74 68 69 73 2e 73 63 68 65 64 75 6c 65 48 61 72 76 65 73 74 28 29 29 3b 69 3d 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 69 29 3f 69 3a 5b 69 5d 2c 6e 2e 70 75 73 68 28 2e 2e 2e 69 29 7d 6c 65 74 20 6f 3d 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 58 28 65 29 3b 6e 2e 6c 65 6e 67 74 68 3f 6f 3d 74 68 69 73 2e 6f 70 74 73 2e 72 61 77 3f 65 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 5f 73 65 6e 64 28 65 29 3a 65 3d Data Ascii: ===r.Be;if(i=this.opts.getPayload({retry:t}),!i)return void(this.started&&this.scheduleHarvest());i="[object Array]"===Object.prototype.toString.call(i)?i:[i],n.push(...i)}let o=e=>this.harvest.sendX(e);n.length?o=this.opts.raw?e=>this.harvest._send(e):e=
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 79 7b 74 3d 6e 65 77 20 55 52 4c 28 65 2c 73 2e 68 72 65 66 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 6e 7d 6e 2e 70 6f 72 74 3d 74 2e 70 6f 72 74 3b 76 61 72 20 6f 3d 74 2e 68 72 65 66 2e 73 70 6c 69 74 28 22 3a 2f 2f 22 29 3b 21 6e 2e 70 6f 72 74 26 26 6f 5b 31 5d 26 26 28 6e 2e 70 6f 72 74 3d 6f 5b 31 5d 2e 73 70 6c 69 74 28 22 2f 22 29 5b 30 5d 2e 73 70 6c 69 74 28 22 40 22 29 2e 70 6f 70 28 29 2e 73 70 6c 69 74 28 22 3a 22 29 5b 31 5d 29 2c 6e 2e 70 6f 72 74 26 26 22 30 22 21 3d 3d 6e 2e 70 6f 72 74 7c 7c 28 6e 2e 70 6f 72 74 3d 22 68 74 74 70 73 22 3d 3d 3d 6f 5b 30 5d 3f 22 34 34 33 22 3a 22 38 30 22 29 2c 6e 2e 68 6f 73 74 6e 61 6d 65 3d 74 2e 68 6f 73 74 6e 61 6d 65 7c 7c 73 2e 68 6f 73 74 6e 61 6d 65 2c 6e 2e 70 61 74 68 6e 61 6d 65 Data Ascii: y{t=new URL(e,s.href)}catch(e){return n}n.port=t.port;var o=t.href.split("://");!n.port&&o[1]&&(n.port=o[1].split("/")[0].split("@").pop().split(":")[1]),n.port&&"0"!==n.port\|\|(n.port="https"===o[0]?"443":"80"),n.hostname=t.hostname\|\|s.hostname,n.pathname
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 65 74 75 72 6e 3b 74 68 69 73 2e 72 65 73 6f 75 72 63 65 4f 62 73 65 72 76 65 72 3d 73 3f 2e 72 65 73 6f 75 72 63 65 4f 62 73 65 72 76 65 72 2c 74 68 69 73 2e 70 74 69 64 3d 22 22 2c 74 68 69 73 2e 74 72 61 63 65 3d 7b 7d 2c 74 68 69 73 2e 6e 6f 64 65 43 6f 75 6e 74 3d 30 2c 74 68 69 73 2e 73 65 6e 74 54 72 61 63 65 3d 6e 75 6c 6c 2c 74 68 69 73 2e 68 61 72 76 65 73 74 54 69 6d 65 53 65 63 6f 6e 64 73 3d 28 30 2c 6f 2e 4d 74 29 28 65 2c 22 73 65 73 73 69 6f 6e 5f 74 72 61 63 65 2e 68 61 72 76 65 73 74 54 69 6d 65 53 65 63 6f 6e 64 73 22 29 7c 7c 31 30 2c 74 68 69 73 2e 6d 61 78 4e 6f 64 65 73 50 65 72 48 61 72 76 65 73 74 3d 28 30 2c 6f 2e 4d 74 29 28 65 2c 22 73 65 73 73 69 6f 6e 5f 74 72 61 63 65 2e 6d 61 78 4e 6f 64 65 73 50 65 72 48 61 72 76 65 73 74 Data Ascii: eturn;this.resourceObserver=s?.resourceObserver,this.ptid="",this.trace={},this.nodeCount=0,this.sentTrace=null,this.harvestTimeSeconds=(0,o.Mt)(e,"session_trace.harvestTimeSeconds")\|\|10,this.maxNodesPerHarvest=(0,o.Mt)(e,"session_trace.maxNodesPerHarvest
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 70 6c 61 79 26 26 61 77 61 69 74 20 74 2e 69 6e 69 74 69 61 6c 69 7a 65 64 41 67 65 6e 74 73 5b 65 5d 2e 66 65 61 74 75 72 65 73 2e 73 65 73 73 69 6f 6e 5f 72 65 70 6c 61 79 2e 6f 6e 41 67 67 72 65 67 61 74 65 49 6d 70 6f 72 74 65 64 29 72 65 74 75 72 6e 20 61 77 61 69 74 20 70 2e 6d 2e 73 65 73 73 69 6f 6e 52 65 70 6c 61 79 49 6e 69 74 69 61 6c 69 7a 65 64 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 6c 2e 49 4b 2e 4f 46 46 7d 28 65 29 3b 6c 65 74 20 69 3b 72 3d 3d 3d 6c 2e 49 4b 2e 4f 46 46 26 26 28 74 68 69 73 2e 69 73 53 74 61 6e 64 61 6c 6f 6e 65 3d 21 30 29 2c 69 3d 21 30 3d 3d 3d 6e 7c 7c 72 3d 3d 3d 6c 2e 49 4b 2e 45 52 52 4f 52 26 26 73 3f 6c 2e 49 4b 2e 46 55 4c 4c 3a 72 2c 61 2e 77 72 69 74 65 28 7b 73 65 73 73 69 6f 6e 54 72 61 63 65 Data Ascii: play&&await t.initializedAgents[e].features.session_replay.onAggregateImported)return await p.m.sessionReplayInitialized}catch(e){}return l.IK.OFF}(e);let i;r===l.IK.OFF&&(this.isStandalone=!0),i=!0===n\|\|r===l.IK.ERROR&&s?l.IK.FULL:r,a.write({sessionTrace
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 74 3d 6e 65 77 20 41 72 72 61 79 28 65 29 2c 73 3d 30 3b 73 3c 65 3b 73 2b 2b 29 74 5b 73 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 3b 72 65 74 75 72 6e 20 6e 2e 73 65 74 74 6c 65 28 28 28 29 3d 3e 69 2e 73 74 6f 72 65 45 72 72 6f 72 41 67 67 28 2e 2e 2e 74 29 29 29 7d 29 2c 74 68 69 73 2e 66 65 61 74 75 72 65 4e 61 6d 65 2c 74 68 69 73 2e 65 65 29 2c 28 30 2c 72 2e 58 29 28 22 70 76 74 41 64 64 65 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 74 3d 6e 65 77 20 41 72 72 61 79 28 65 29 2c 73 3d 30 3b 73 3c 65 3b 73 2b 2b 29 74 5b 73 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 3b 72 65 74 75 72 6e 20 6e 2e 73 65 74 74 6c 65 28 28 28 29 3d Data Ascii: uments.length,t=new Array(e),s=0;s<e;s++)t[s]=arguments[s];return n.settle((()=>i.storeErrorAgg(...t)))}),this.featureName,this.ee),(0,r.X)("pvtAdded",(function(){for(var e=arguments.length,t=new Array(e),s=0;s<e;s++)t[s]=arguments[s];return n.settle((()=
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 49 4b 2e 4f 46 46 26 26 30 3d 3d 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 68 69 73 2e 74 72 61 63 65 29 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 3b 69 66 28 65 3d 3d 3d 6c 2e 49 4b 2e 45 52 52 4f 52 29 72 65 74 75 72 6e 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 74 61 6b 65 53 54 4e 73 28 65 2e 72 65 74 72 79 29 7d 70 72 6f 63 65 73 73 50 56 54 28 65 2c 74 2c 73 29 7b 74 68 69 73 2e 73 74 6f 72 65 54 69 6d 69 6e 67 28 7b 5b 65 5d 3a 74 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 22 66 69 22 3d 3d 3d 65 26 26 21 21 74 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 2e 66 69 64 7d 28 65 2c 73 29 26 26 74 68 69 73 2e 73 74 6f 72 65 45 76 65 6e 74 28 7b 74 79 70 65 3a 22 66 69 64 22 2c 74 61 72 67 65 74 3a 22 64 6f 63 75 6d Data Ascii: IK.OFF&&0===Object.keys(this.trace).length)return;if(e===l.IK.ERROR)return}return this.takeSTNs(e.retry)}processPVT(e,t,s){this.storeTiming({[e]:t}),function(e,t){return"fi"===e&&!!t&&"number"==typeof t.fid}(e,s)&&this.storeEvent({type:"fid",target:"docum
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 6f 73 74 2b 74 2e 70 61 74 68 6e 61 6d 65 7d 65 6c 73 65 20 69 66 28 65 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 74 61 67 4e 61 6d 65 26 26 28 73 3d 65 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 65 2e 69 64 26 26 28 73 2b 3d 22 23 22 2b 65 2e 69 64 29 2c 65 2e 63 6c 61 73 73 4e 61 6d 65 29 29 66 6f 72 28 6c 65 74 20 74 3d 30 3b 74 3c 65 2e 63 6c 61 73 73 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 73 2b 3d 22 2e 22 2b 65 2e 63 6c 61 73 73 4c 69 73 74 5b 74 5d 3b 72 65 74 75 72 6e 22 75 6e 6b 6e 6f 77 6e 22 3d 3d 3d 73 26 26 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f 73 3d 74 3a 74 3d 3d 3d 64 6f 63 75 6d 65 6e 74 3f 73 3d 22 64 6f 63 75 6d 65 6e 74 22 3a 74 3d 3d 3d 77 69 6e 64 6f 77 3f Data Ascii: ost+t.pathname}else if(e&&"string"==typeof e.tagName&&(s=e.tagName.toLowerCase(),e.id&&(s+="#"+e.id),e.className))for(let t=0;t<e.classList.length;t++)s+="."+e.classList[t];return"unknown"===s&&("string"==typeof t?s=t:t===document?s="document":t===window?
2024-04-26 17:13:22 UTC	1122	IN	Data Raw: 69 26 26 28 69 3c 30 3f 28 69 3d 72 2e 6c 65 6e 67 74 68 2c 64 65 6c 65 74 65 20 74 68 69 73 2e 74 72 61 63 65 5b 65 5d 29 3a 72 2e 73 70 6c 69 63 65 28 30 2c 69 29 2c 74 68 69 73 2e 6e 6f 64 65 43 6f 75 6e 74 2d 3d 69 2c 74 2b 3d 69 29 7d 29 29 2c 74 7d 74 61 6b 65 53 54 4e 73 28 65 29 7b 74 68 69 73 2e 72 65 73 6f 75 72 63 65 4f 62 73 65 72 76 65 72 7c 7c 74 68 69 73 2e 73 74 6f 72 65 52 65 73 6f 75 72 63 65 73 28 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 28 22 72 65 73 6f 75 72 63 65 22 29 29 3b 63 6f 6e 73 74 20 74 3d 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 28 74 68 69 73 2e 74 72 61 63 65 29 2e 66 6c 61 74 4d 61 70 28 28 65 3d 3e 7b 6c 65 74 5b 74 2c 73 5d 3d 65 3b 69 66 28 21 28 74 20 Data Ascii: i&&(i<0?(i=r.length,delete this.trace[e]):r.splice(0,i),this.nodeCount-=i,t+=i)})),t}takeSTNs(e){this.resourceObserver\|\|this.storeResources(window.performance.getEntriesByType("resource"));const t=Object.entries(this.trace).flatMap((e=>{let[t,s]=e;if(!(t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.5	49996	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	562	OUT	GET /page_action-aggregate.ac76d497-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	833	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4643 x-amz-id-2: wAYaL4p4E5lp/GmGUCC9rlGWSo/SSQGq2uZSZfdme78p7ocv6qbL+9u0jr77wPb3e/Z5mr0mmACcM+OSPMODZSR7USh9XHJdH7WFOMr6VQg= x-amz-request-id: W4Q5TADAYMGZKFYT Last-Modified: Wed, 18 Oct 2023 21:34:23 GMT ETag: "8862791debd0b259297a0ccf618932eb" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: dq9G4xn01_QwtwzwaNCz9IM9g3AQWz7v Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760095-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 38 5d 2c 7b 32 35 37 33 3a 28 74 2c 65 2c 73 29 3d 3e 7b 73 2e 64 28 65 2c 7b 6f 3a 28 29 3d 3e 64 7d 29 3b 76 61 72 20 69 3d 73 28 34 32 34 37 29 2c 6e 3d 73 28 31 31 31 37 29 2c 72 3d 73 28 38 36 37 33 29 2c 61 3d 73 28 38 33 31 30 29 2c 6f 3d 73 28 35 37 36 33 29 2c 68 3d 73 28 33 38 36 30 29 3b 63 6c 61 73 73 20 64 20 65 78 74 65 6e 64 73 20 6e 2e 77 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 2c 65 2c 73 29 7b 73 75 70 65 72 28 73 29 2c 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 3d 74 2c 74 68 69 73 2e 6f 70 74 73 3d 65 7c 7c 7b 7d 2c Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[78],{2573:(t,e,s)=>{s.d(e,{o:()=>d});var i=s(4247),n=s(1117),r=s(8673),a=s(8310),o=s(5763),h=s(3860);class d extends n.w{constructor(t,e,s){super(s),this.endpoint=t,this.opts=e\|\|{},
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 6e 29 3f 6e 3a 5b 6e 5d 2c 72 2e 70 75 73 68 28 2e 2e 2e 6e 29 7d 6c 65 74 20 61 3d 74 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 58 28 74 29 3b 72 2e 6c 65 6e 67 74 68 3f 61 3d 74 68 69 73 2e 6f 70 74 73 2e 72 61 77 3f 74 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 5f 73 65 6e 64 28 74 29 3a 74 3d 3e 74 68 69 73 2e 68 61 72 76 65 73 74 2e 73 65 6e 64 28 74 29 3a 72 2e 70 75 73 68 28 76 6f 69 64 20 30 29 2c 72 2e 66 6f 72 45 61 63 68 28 28 69 3d 3e 7b 61 28 7b 65 6e 64 70 6f 69 6e 74 3a 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 2c 70 61 79 6c 6f 61 64 3a 69 2c 6f 70 74 73 3a 74 2c 73 75 62 6d 69 74 4d 65 74 68 6f 64 3a 73 2c 63 62 46 69 6e 69 73 68 65 64 3a 65 2c 63 75 73 74 6f 6d 55 72 6c Data Ascii: ype.toString.call(n)?n:[n],r.push(...n)}let a=t=>this.harvest.sendX(t);r.length?a=this.opts.raw?t=>this.harvest._send(t):t=>this.harvest.send(t):r.push(void 0),r.forEach((i=>{a({endpoint:this.endpoint,payload:i,opts:t,submitMethod:s,cbFinished:e,customUrl
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 2c 22 69 6e 73 2e 68 61 72 76 65 73 74 54 69 6d 65 53 65 63 6f 6e 64 73 22 29 7c 7c 33 30 2c 74 68 69 73 2e 65 76 65 6e 74 73 50 65 72 48 61 72 76 65 73 74 3d 74 68 69 73 2e 65 76 65 6e 74 73 50 65 72 4d 69 6e 75 74 65 2a 74 68 69 73 2e 68 61 72 76 65 73 74 54 69 6d 65 53 65 63 6f 6e 64 73 2f 36 30 2c 74 68 69 73 2e 72 65 66 65 72 72 65 72 55 72 6c 2c 74 68 69 73 2e 63 75 72 72 65 6e 74 45 76 65 6e 74 73 2c 74 68 69 73 2e 65 76 65 6e 74 73 3d 5b 5d 2c 74 68 69 73 2e 61 74 74 3d 28 30 2c 68 2e 43 35 29 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 2e 6a 73 41 74 74 72 69 62 75 74 65 73 2c 6c 2e 69 6c 26 26 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 26 26 28 74 68 69 73 Data Ascii: this.agentIdentifier,"ins.harvestTimeSeconds")\|\|30,this.eventsPerHarvest=this.eventsPerMinute*this.harvestTimeSeconds/60,this.referrerUrl,this.currentEvents,this.events=[],this.att=(0,h.C5)(this.agentIdentifier).jsAttributes,l.il&&document.referrer&&(this
2024-04-26 17:13:22 UTC	509	IN	Data Raw: 74 69 6d 65 73 74 61 6d 70 3a 74 2b 28 30 2c 68 2e 4f 50 29 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 2e 6f 66 66 73 65 74 2c 74 69 6d 65 53 69 6e 63 65 4c 6f 61 64 3a 74 2f 31 65 33 2c 62 72 6f 77 73 65 72 57 69 64 74 68 3a 72 2c 62 72 6f 77 73 65 72 48 65 69 67 68 74 3a 61 2c 72 65 66 65 72 72 65 72 55 72 6c 3a 74 68 69 73 2e 72 65 66 65 72 72 65 72 55 72 6c 2c 63 75 72 72 65 6e 74 55 72 6c 3a 28 30 2c 6f 2e 66 29 28 22 22 2b 6c 6f 63 61 74 69 6f 6e 29 2c 70 61 67 65 55 72 6c 3a 28 30 2c 6f 2e 66 29 28 28 30 2c 68 2e 4f 50 29 28 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 2e 6f 72 69 67 69 6e 29 2c 65 76 65 6e 74 54 79 70 65 3a 22 50 61 67 65 41 63 74 69 6f 6e 22 7d 3b 28 30 2c 69 2e 44 29 28 75 2c 63 29 2c 28 Data Ascii: timestamp:t+(0,h.OP)(this.agentIdentifier).offset,timeSinceLoad:t/1e3,browserWidth:r,browserHeight:a,referrerUrl:this.referrerUrl,currentUrl:(0,o.f)(""+location),pageUrl:(0,o.f)((0,h.OP)(this.agentIdentifier).origin),eventType:"PageAction"};(0,i.D)(u,c),(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.5	49995	162.247.243.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	554	OUT	GET /spa-aggregate.e6b09d52-1.236.0.min.js HTTP/1.1 Host: js-agent.newrelic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:22 UTC	802	IN	HTTP/1.1 200 OK Connection: close Content-Length: 20843 x-amz-id-2: eRoaqRla3AFLKaZ2NqbLqRMwNrZ1d6I7rkcTFiVrYQA8IhUzIycipDUTXEHsaF9Hj3dIfUaHokw= x-amz-request-id: W4Q7HBFSQCK091X2 Last-Modified: Wed, 18 Oct 2023 21:36:35 GMT ETag: "27ef55ddf9eded9cf24ce8747e8bbe04" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 x-amz-version-id: drxqY6SpM4cwKd1P3dYcbVYIBU2GvQuP Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:22 GMT Via: 1.1 varnish X-Served-By: cache-mia-kmia1760081-MIA X-Cache: MISS X-Cache-Hits: 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=300
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 4e 52 42 41 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 37 33 5d 2c 7b 31 31 39 39 3a 28 74 2c 65 2c 69 29 3d 3e 7b 69 2e 64 28 65 2c 7b 52 3a 28 29 3d 3e 73 2c 7a 3a 28 29 3d 3e 72 7d 29 3b 76 61 72 20 6e 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 74 29 7b 69 66 28 30 3d 3d 3d 6e 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 30 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 74 2e 68 6f 73 74 6e 61 6d 65 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 6e 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 69 3d 6e 5b 65 5d 3b 69 66 28 22 2a 22 3d 3d 3d 69 2e 68 6f 73 74 6e Data Ascii: "use strict";(window.webpackChunkNRBA=window.webpackChunkNRBA\|\|[]).push([[873],{1199:(t,e,i)=>{i.d(e,{R:()=>s,z:()=>r});var n=[];function r(t){if(0===n.length)return!0;if(void 0===t.hostname)return!1;for(var e=0;e<n.length;e++){var i=n[e];if("*"===i.hostn
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 65 72 76 61 6c 3d 74 2c 74 68 69 73 2e 73 74 61 72 74 65 64 3d 21 30 2c 74 68 69 73 2e 73 63 68 65 64 75 6c 65 48 61 72 76 65 73 74 28 6e 75 6c 6c 21 3d 65 3f 65 3a 74 68 69 73 2e 69 6e 74 65 72 76 61 6c 29 7d 73 74 6f 70 54 69 6d 65 72 28 29 7b 6c 65 74 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3b 74 68 69 73 2e 61 62 6f 72 74 65 64 3d 74 2c 74 68 69 73 2e 73 74 61 72 74 65 64 3d 21 31 2c 74 68 69 73 2e 74 69 6d 65 6f 75 74 48 61 6e 64 6c 65 26 26 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 74 69 6d 65 6f 75 74 48 61 6e 64 6c 65 29 7d 73 63 68 65 64 75 6c 65 48 61 72 76 65 73 74 28 74 2c 65 29 7b 74 68 69 73 2e 74 Data Ascii: erval=t,this.started=!0,this.scheduleHarvest(null!=e?e:this.interval)}stopTimer(){let t=arguments.length>0&&void 0!==arguments[0]&&arguments[0];this.aborted=t,this.started=!1,this.timeoutHandle&&clearTimeout(this.timeoutHandle)}scheduleHarvest(t,e){this.t
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 63 6f 6e 73 74 20 6e 3d 7b 7d 7d 2c 32 31 34 3a 28 74 2c 65 2c 69 29 3d 3e 7b 69 2e 64 28 65 2c 7b 41 47 3a 28 29 3d 3e 68 2c 46 58 3a 28 29 3d 3e 63 2c 6e 31 3a 28 29 3d 3e 64 2c 75 52 3a 28 29 3d 3e 75 7d 29 3b 76 61 72 20 6e 3d 69 28 31 32 38 34 29 2c 72 3d 69 28 34 33 35 31 29 2c 73 3d 69 28 36 31 34 31 29 2c 61 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6f 3d 36 34 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 65 2c 69 29 7b 72 65 74 75 72 6e 20 74 7c 7c 30 3d 3d 3d 74 7c 7c 22 22 3d 3d 3d 74 3f 65 28 74 29 2b 28 69 3f 22 2c 22 3a 22 22 29 3a 22 21 22 7d 66 75 6e 63 74 69 6f 6e 20 75 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 65 3f 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 29 2e 74 6f 53 74 72 69 6e 67 28 33 Data Ascii: const n={}},214:(t,e,i)=>{i.d(e,{AG:()=>h,FX:()=>c,n1:()=>d,uR:()=>u});var n=i(1284),r=i(4351),s=i(6141),a=Object.prototype.hasOwnProperty,o=64;function h(t,e,i){return t\|\|0===t\|\|""===t?e(t)+(i?",":""):"!"}function u(t,e){return e?Math.floor(t).toString(3
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 66 65 74 63 68 22 2b 6e 5d 2c 69 2c 22 66 22 2c 66 29 2c 4e 28 65 5b 6f 2b 6e 5d 2c 69 2c 22 64 6e 22 2c 66 29 2c 4e 28 65 5b 6f 2b 72 5d 2c 69 2c 22 64 6e 65 22 2c 66 29 2c 4e 28 65 5b 22 63 22 2b 68 2b 6e 5d 2c 69 2c 22 63 22 2c 66 29 2c 4e 28 65 5b 22 73 65 63 75 72 65 43 22 2b 68 2b 22 69 6f 6e 22 2b 6e 5d 2c 69 2c 22 73 22 2c 66 29 2c 4e 28 65 5b 22 63 22 2b 68 2b 72 5d 2c 69 2c 22 63 65 22 2c 66 29 2c 4e 28 65 5b 75 2b 6e 5d 2c 69 2c 22 72 71 22 2c 66 29 2c 4e 28 65 5b 63 2b 6e 5d 2c 69 2c 22 72 70 22 2c 66 29 2c 4e 28 65 5b 63 2b 72 5d 2c 69 2c 22 72 70 65 22 2c 66 29 2c 4e 28 65 2e 64 6f 6d 4c 6f 61 64 69 6e 67 2c 69 2c 22 64 6c 22 2c 66 29 2c 4e 28 65 2e 64 6f 6d 49 6e 74 65 72 61 63 74 69 76 65 2c 69 2c 22 64 69 22 2c 66 29 2c 4e 28 65 5b 6c 2b Data Ascii: fetch"+n],i,"f",f),N(e[o+n],i,"dn",f),N(e[o+r],i,"dne",f),N(e["c"+h+n],i,"c",f),N(e["secureC"+h+"ion"+n],i,"s",f),N(e["c"+h+r],i,"ce",f),N(e[u+n],i,"rq",f),N(e[c+n],i,"rp",f),N(e[c+r],i,"rpe",f),N(e.domLoading,i,"dl",f),N(e.domInteractive,i,"di",f),N(e[l+
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 70 6c 69 74 28 22 2f 22 29 5b 30 5d 2e 73 70 6c 69 74 28 22 40 22 29 2e 70 6f 70 28 29 2e 73 70 6c 69 74 28 22 3a 22 29 5b 31 5d 29 2c 73 2e 70 6f 72 74 26 26 22 30 22 21 3d 3d 73 2e 70 6f 72 74 7c 7c 28 73 2e 70 6f 72 74 3d 22 68 74 74 70 73 22 3d 3d 3d 61 5b 30 5d 3f 22 34 34 33 22 3a 22 38 30 22 29 2c 73 2e 68 6f 73 74 6e 61 6d 65 3d 65 2e 68 6f 73 74 6e 61 6d 65 7c 7c 69 2e 68 6f 73 74 6e 61 6d 65 2c 73 2e 70 61 74 68 6e 61 6d 65 3d 65 2e 70 61 74 68 6e 61 6d 65 2c 73 2e 70 72 6f 74 6f 63 6f 6c 3d 61 5b 30 5d 2c 22 2f 22 21 3d 3d 73 2e 70 61 74 68 6e 61 6d 65 2e 63 68 61 72 41 74 28 30 29 26 26 28 73 2e 70 61 74 68 6e 61 6d 65 3d 22 2f 22 2b 73 2e 70 61 74 68 6e 61 6d 65 29 3b 76 61 72 20 6f 3d 21 65 2e 70 72 6f 74 6f 63 6f 6c 7c 7c 22 3a 22 3d 3d 3d Data Ascii: plit("/")[0].split("@").pop().split(":")[1]),s.port&&"0"!==s.port\|\|(s.port="https"===a[0]?"443":"80"),s.hostname=e.hostname\|\|i.hostname,s.pathname=e.pathname,s.protocol=a[0],"/"!==s.pathname.charAt(0)&&(s.pathname="/"+s.pathname);var o=!e.protocol\|\|":"===
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 54 28 74 2c 65 2c 69 2c 6e 2c 72 2c 73 29 7b 74 68 69 73 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 3d 73 2c 74 68 69 73 2e 65 65 3d 64 2e 65 65 2e 67 65 74 28 73 29 2c 67 5b 73 5d 3d 30 2c 74 68 69 73 2e 69 64 3d 2b 2b 67 5b 73 5d 2c 74 68 69 73 2e 65 76 65 6e 74 4e 61 6d 65 3d 74 2c 74 68 69 73 2e 6e 6f 64 65 73 3d 30 2c 74 68 69 73 2e 72 65 6d 61 69 6e 69 6e 67 3d 30 2c 74 68 69 73 2e 66 69 6e 69 73 68 54 69 6d 65 72 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 68 65 63 6b 69 6e 67 46 69 6e 69 73 68 3d 21 31 2c 74 68 69 73 2e 6c 61 73 74 43 62 3d 74 68 69 73 2e 6c 61 73 74 46 69 6e 69 73 68 3d 65 2c 74 68 69 73 2e 68 61 6e 64 6c 65 72 73 3d 5b 5d 2c 74 68 69 73 2e 6f 6e 46 69 6e 69 73 68 65 64 3d 72 2c 74 68 69 73 2e 64 6f 6e 65 Data Ascii: function T(t,e,i,n,r,s){this.agentIdentifier=s,this.ee=d.ee.get(s),g[s]=0,this.id=++g[s],this.eventName=t,this.nodes=0,this.remaining=0,this.finishTimer=null,this.checkingFinish=!1,this.lastCb=this.lastFinish=e,this.handlers=[],this.onFinished=r,this.done
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 73 74 54 69 6d 65 73 74 61 6d 70 3d 76 6f 69 64 20 30 7d 73 65 72 69 61 6c 69 7a 65 4d 75 6c 74 69 70 6c 65 28 74 2c 65 2c 69 29 7b 63 6f 6e 73 74 20 6e 3d 28 30 2c 63 2e 43 35 29 28 74 68 69 73 2e 73 68 61 72 65 64 43 6f 6e 74 65 78 74 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 3b 76 61 72 20 72 3d 28 30 2c 78 2e 46 58 29 28 74 68 69 73 2e 73 68 61 72 65 64 43 6f 6e 74 65 78 74 2e 61 67 65 6e 74 49 64 65 6e 74 69 66 69 65 72 29 2c 73 3d 22 62 65 6c 2e 37 22 3b 72 65 74 75 72 6e 20 74 2e 66 6f 72 45 61 63 68 28 28 74 3d 3e 7b 73 2b 3d 22 3b 22 2b 74 68 69 73 2e 73 65 72 69 61 6c 69 7a 65 49 6e 74 65 72 61 63 74 69 6f 6e 28 74 2e 72 6f 6f 74 2c 65 2c 69 2c 74 2e 72 6f 75 74 65 43 68 61 6e 67 65 2c 72 2c 6e 29 7d 29 29 2c 74 68 69 73 2e 66 69 72 73 Data Ascii: stTimestamp=void 0}serializeMultiple(t,e,i){const n=(0,c.C5)(this.sharedContext.agentIdentifier);var r=(0,x.FX)(this.sharedContext.agentIdentifier),s="bel.7";return t.forEach((t=>{s+=";"+this.serializeInteraction(t.root,e,i,t.routeChange,r,n)})),this.firs
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 69 72 73 74 43 6f 6e 74 65 6e 74 66 75 6c 50 61 69 6e 74 2c 78 2e 75 52 2c 21 31 29 29 3b 76 61 72 20 46 3d 28 30 2c 78 2e 6e 31 29 28 52 2e 63 75 73 74 6f 6d 2c 72 29 3b 54 3d 54 2e 63 6f 6e 63 61 74 28 46 29 2c 4e 3d 46 2e 6c 65 6e 67 74 68 2c 76 26 26 28 70 2b 2b 2c 54 2e 70 75 73 68 28 22 61 2c 22 2b 72 28 76 29 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 43 2e 70 75 73 68 28 72 28 62 2e 6d 65 74 68 6f 64 29 2c 28 30 2c 78 2e 75 52 29 28 62 2e 73 74 61 74 75 73 29 2c 72 28 62 2e 68 6f 73 74 29 2c 72 28 62 2e 70 61 74 68 6e 61 6d 65 29 2c 28 30 2c 78 2e 75 52 29 28 45 2e 74 78 53 69 7a 65 29 2c 28 30 2c 78 2e 75 52 29 28 45 2e 72 78 53 69 7a 65 29 2c 52 2e 69 73 46 65 74 63 68 3f 31 3a 52 2e 69 73 4a 53 4f 4e 50 3f 32 3a 22 22 2c 72 28 74 2e 69 64 Data Ascii: irstContentfulPaint,x.uR,!1));var F=(0,x.n1)(R.custom,r);T=T.concat(F),N=F.length,v&&(p++,T.push("a,"+r(v)));break;case 2:C.push(r(b.method),(0,x.uR)(b.status),r(b.host),r(b.pathname),(0,x.uR)(E.txSize),(0,x.uR)(E.rxSize),R.isFetch?1:R.isJSONP?2:"",r(t.id
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 2c 22 73 70 61 2e 68 61 72 76 65 73 74 54 69 6d 65 53 65 63 6f 6e 64 73 22 29 7c 7c 31 30 2c 69 6e 74 65 72 61 63 74 69 6f 6e 73 54 6f 48 61 72 76 65 73 74 3a 5b 5d 2c 69 6e 74 65 72 61 63 74 69 6f 6e 73 53 65 6e 74 3a 5b 5d 7d 2c 74 68 69 73 2e 73 65 72 69 61 6c 69 7a 65 72 3d 6e 65 77 20 41 28 74 68 69 73 29 3b 63 6f 6e 73 74 7b 73 74 61 74 65 3a 69 2c 73 65 72 69 61 6c 69 7a 65 72 3a 6c 7d 3d 74 68 69 73 3b 6c 65 74 7b 62 6c 6f 63 6b 65 64 3a 66 7d 3d 74 68 69 73 3b 63 6f 6e 73 74 20 6d 3d 64 2e 65 65 2e 67 65 74 28 74 29 2c 70 3d 6d 2e 67 65 74 28 22 6d 75 74 61 74 69 6f 6e 22 29 2c 4e 3d 6d 2e 67 65 74 28 22 70 72 6f 6d 69 73 65 22 29 2c 76 3d 6d 2e 67 65 74 28 22 68 69 73 74 6f 72 79 22 29 2c 67 3d 6d 2e 67 65 74 28 22 65 76 65 6e 74 73 22 29 2c 52 Data Ascii: ,"spa.harvestTimeSeconds")\|\|10,interactionsToHarvest:[],interactionsSent:[]},this.serializer=new A(this);const{state:i,serializer:l}=this;let{blocked:f}=this;const m=d.ee.get(t),p=m.get("mutation"),N=m.get("promise"),v=m.get("history"),g=m.get("events"),R
2024-04-26 17:13:22 UTC	1378	IN	Data Raw: 28 74 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 28 71 29 7d 29 2c 5f 2e 44 2e 73 70 61 2c 6d 29 2c 28 30 2c 6e 2e 58 29 28 79 2c 56 2c 74 68 69 73 2e 66 65 61 74 75 72 65 4e 61 6d 65 2c 6d 29 2c 28 30 2c 6e 2e 58 29 28 22 63 62 2d 65 6e 64 22 2c 56 2c 74 68 69 73 2e 66 65 61 74 75 72 65 4e 61 6d 65 2c 4e 29 2c 28 30 2c 6e 2e 58 29 28 4f 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 72 3d 65 5b 30 5d 2c 73 3d 72 2e 74 79 70 65 2c 61 3d 72 2e 5f 5f 6e 72 4e 6f 64 65 3b 69 66 28 69 2e 70 61 67 65 4c 6f 61 64 65 64 7c 7c 22 6c 6f 61 64 22 21 3d 3d 73 7c 7c 6e 21 3d 3d 77 69 6e 64 6f 77 7c 7c 28 69 2e 70 61 67 65 4c 6f 61 64 65 64 3d 21 30 2c 74 68 69 73 2e 70 72 65 76 4e 6f 64 65 3d 69 2e 63 75 72 72 65 6e 74 4e Data Ascii: (t){"function"==typeof t&&t(q)}),_.D.spa,m),(0,n.X)(y,V,this.featureName,m),(0,n.X)("cb-end",V,this.featureName,N),(0,n.X)(O,(function(e,n){var r=e[0],s=r.type,a=r.__nrNode;if(i.pageLoaded\|\|"load"!==s\|\|n!==window\|\|(i.pageLoaded=!0,this.prevNode=i.currentN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.5	49992	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	1378	OUT	GET /js_tracking?url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F&uid=XVsUfradtXcBUl5XS45ldg&v=1&host=https%3A%2F%2Fwww.xero.com HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:22 UTC	242	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:13:22 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.5	49997	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	735	OUT	GET /universal_pixel.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://match.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwjE0cDWxofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUoAzILCIiQw4Pdh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:13:23 UTC	498	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 488 Connection: close Date: Fri, 26 Apr 2024 17:13:23 GMT Last-Modified: Thu, 25 Apr 2024 19:49:38 GMT ETag: "2775054c068b37509e0798448f7fd32c" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 72f1be3bce796ddaae99db9da8d6be8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: 3R5B6WNHpSTbje5uZn9_Q4gAZxVEVftTfA6XPzZeAvpkZwr5VyVBPg==
2024-04-26 17:13:23 UTC	488	IN	Data Raw: 76 61 72 20 54 54 44 43 4d 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 20 7b 20 76 61 72 20 65 20 3d 20 22 69 66 72 61 6d 65 5f 22 20 2b 20 74 68 69 73 2e 6d 61 70 49 6e 64 65 78 2b 2b 2c 20 69 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 20 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 20 65 29 2c 20 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 6c 6c 6f 77 54 72 61 6e 73 70 61 72 65 6e 63 79 22 2c 20 21 30 29 2c 20 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 68 65 69 67 68 74 22 2c 20 30 29 2c 20 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 77 69 64 74 68 22 2c 20 30 29 2c 20 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 Data Ascii: var TTDCM = function () { function n(t) { var e = "iframe_" + this.mapIndex++, i = document.createElement("iframe"); i.setAttribute("id", e), i.setAttribute("allowTransparency", !0), i.setAttribute("height", 0), i.setAttribute("width", 0), i.setAttribute(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.5	49999	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:22 UTC	914	OUT	GET /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=23183&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/&af=err,xhr,stn,ins,spa&be=923&fe=19419&dc=4715&perf=%7B%22timing%22:%7B%22of%22:1714151578018,%22n%22:0,%22r%22:3,%22re%22:740,%22f%22:740,%22dn%22:740,%22dne%22:740,%22c%22:740,%22s%22:740,%22ce%22:740,%22rq%22:741,%22rp%22:923,%22rpe%22:3428,%22di%22:4527,%22ds%22:5638,%22de%22:5638,%22dc%22:20330,%22l%22:20331,%22le%22:20342%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=3405&fcp=3405 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:23 UTC	396	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:13:23 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * x-served-by: cache-mia-kmia1760026-MIA
2024-04-26 17:13:23 UTC	79	IN	Data Raw: 5b 37 31 2c 20 37 33 2c 20 37 30 2c 20 35 36 2c 20 35 37 2c 20 39 37 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 34 34 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 32 5d Data Ascii: [71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.5	49998	34.196.171.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:23 UTC	364	OUT	GET /messenger/web/metrics HTTP/1.1 Host: api-iam.intercom.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:23 UTC	4209	IN	HTTP/1.1 406 Not Acceptable Date: Fri, 26 Apr 2024 17:13:23 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 144 Connection: close Status: 406 Not Acceptable Vary: Accept-Encoding Strict-Transport-Security: max-age=31556952; includeSubDomains; preload X-XSS-Protection: 1; mode=block X-Request-Id: 001e41rcvl0cn75el3ng X-Runtime: 0.011925 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' docs.google.com fast.wistia.net fast.wistia.com js.stripe.com hooks.stripe.com platform.twitter.com player.vimeo.com staticxx.facebook.com www.facebook.com web.facebook.com www.loom.com play.vidyard.com web.microsoftstream.com share.synthesia.io embed.app.guidde.com share.descript.com app.guideflow.com www.youtube.com www.youtube-nocookie.com content.jwplatform.com players.brightcove.net intercom-sheets.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com gtm.intercom-marketing.com intercominc.typeform.com www.intercom-reporting.com insight.adsrvr.org apisandbox.zuora.com zuora.com www.zuora.com .my.connect.aws www.recaptcha.net intercom.help intercom-help.eu au.intercom.help sharepoint.com .sharepoint.com; connect-src 'self' app.intercom.com api-iam.intercom.io api-ping.intercom.io api-visitor-analytics.intercom.com nexus-websocket-a.intercom.io via.intercom.io wss://nexus-websocket-a.intercom.io nexus-europe-webso [TRUNCATED] Server: nginx
2024-04-26 17:13:23 UTC	144	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 22 6d 65 64 69 61 5f 74 79 70 65 5f 6e 6f 74 5f 61 63 63 65 70 74 61 62 6c 65 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 54 68 65 20 41 63 63 65 70 74 20 68 65 61 64 65 72 20 73 68 6f 75 6c 64 20 73 65 6e 64 20 61 20 6d 65 64 69 61 20 74 79 70 65 20 6f 66 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 7d 5d 2c 22 74 79 70 65 22 3a 22 65 72 72 6f 72 2e 6c 69 73 74 22 7d Data Ascii: {"errors":[{"code":"media_type_not_acceptable","message":"The Accept header should send a media type of application/json"}],"type":"error.list"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.5	50000	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:23 UTC	781	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=23903&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 2060 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:23 UTC	2060	OUT	Data Raw: 62 65 6c 2e 37 3b 31 2c 71 2c 2c 69 64 73 2c 68 77 30 2c 6c 74 2c 27 69 6e 69 74 69 61 6c 50 61 67 65 4c 6f 61 64 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 74 72 79 2d 6e 6f 77 2f 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 2f 2c 31 2c 31 2c 2c 2c 21 21 21 21 27 34 30 64 63 64 63 65 36 2d 30 61 35 31 2d 34 36 64 63 2d 38 34 64 62 2d 34 38 32 35 63 37 39 39 39 33 30 34 2c 27 31 2c 32 6d 6c 2c 32 6d 6c 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 2c 33 68 37 2c 6e 74 2c 2c 2c 27 50 4f 53 54 2c 35 6c 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 62 34 4c 43 50 68 48 70 6c 6e 56 53 37 2f 7a 2f 46 59 46 30 30 48 71 30 36 34 59 73 77 2f 37 68 37 69 4c 62 45 35 69 75 2f 4b 30 45 53 56 Data Ascii: bel.7;1,q,,ids,hw0,lt,'initialPageLoad,'https://www.xero.com/us/try-now/manage-invoices/,1,1,,,!!!!'40dcdce6-0a51-46dc-84db-4825c7999304,'1,2ml,2ml;5,'siteVersion,'new;2,,3h7,nt,,,'POST,5l,'www.xero.com:443,'/b4LCPhHplnVS7/z/FYF00Hq064Ysw/7h7iLbE5iu/K0ESV
2024-04-26 17:13:23 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:23 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760039-MIA
2024-04-26 17:13:23 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.5	50001	18.204.189.243	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:23 UTC	930	OUT	GET /ibs:dpid=903&dpuuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://match.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; dpm=03520006604032765583882684969024465661
2024-04-26 17:13:23 UTC	899	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 17:13:23 GMT Content-Length: 0 Connection: close X-TID: BJBB58TDTZo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam DCS: dcs-prod-va6-1-v059-01dc51d6d.edge-va6.demdex.com 5 ms set-cookie: dpm=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:23 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:23 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.5	50004	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:23 UTC	534	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=23903&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:24 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:23 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760081-MIA
2024-04-26 17:13:24 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.5	50005	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:24 UTC	911	OUT	GET /track/cmf/generic?ttd_pid=bluekai HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://match.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwjE0cDWxofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUoAzILCIiQw4Pdh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:13:24 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:24 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:24 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwjE0cDWxofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUgASgDMgsIiJDDg92H8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:13:24 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:24 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.5	50008	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:24 UTC	777	OUT	POST /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=49823&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 51 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:24 UTC	51	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 70 61 67 65 48 69 64 65 2c 6a 35 33 2c 31 3b 36 2c 27 63 6c 73 2c 30 2e 30 31 37 37 30 30 30 35 31 39 33 35 32 37 31 32 36 35 Data Ascii: bel.6;e,'pageHide,j53,1;6,'cls,0.017700051935271265
2024-04-26 17:13:24 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:24 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760064-MIA
2024-04-26 17:13:24 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.5	50006	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:24 UTC	907	OUT	GET /track/cmf/generic?ttd_pid=aam HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://match.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwjE0cDWxofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUoAzILCIiQw4Pdh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:13:24 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:24 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:24 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwjE0cDWxofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUgASgDMgsIiJDDg92H8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:13:24 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:24 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.5	50007	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:24 UTC	1022	OUT	GET /track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347&google_gid=CAESEHFXfyZ9kVq0mrodDvvN5-s&google_cver=1 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://match.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwjE0cDWxofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUoAzILCIiQw4Pdh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:13:24 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:24 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:24 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUgASgDMgsIiJDDg92H8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:13:24 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:24 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.5	50009	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:24 UTC	534	OUT	GET /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=49823&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:25 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:25 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760066-MIA
2024-04-26 17:13:25 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.5	50012	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:29 UTC	798	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=30027&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1978 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:29 UTC	1978	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 33 68 37 2c 6e 74 2c 2c 2c 27 50 4f 53 54 2c 35 6c 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 62 34 4c 43 50 68 48 70 6c 6e 56 53 37 2f 7a 2f 46 59 46 30 30 48 71 30 36 34 59 73 77 2f 37 68 37 69 4c 62 45 35 69 75 2f 4b 30 45 53 56 46 6f 59 42 41 2f 58 6e 45 4f 4c 41 2f 56 79 43 54 59 2c 31 6f 79 2c 69 2c 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 33 6a 69 2c 6d 66 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 63 2e 67 6f 2d 6d 70 75 6c 73 65 2e 6e 65 74 3a 34 34 33 2c 27 2f 61 70 69 2f 63 6f 6e 66 69 67 2e 6a 73 6f 6e 2c 2c 31 66 2c 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 34 39 6a 2c 31 65 37 2c 2c 2c 30 2c 35 6d 2c 31 2c 27 2f 61 70 69 2f 65 76 65 6e Data Ascii: bel.7;2,1,3h7,nt,,,'POST,5l,'www.xero.com:443,'/b4LCPhHplnVS7/z/FYF00Hq064Ysw/7h7iLbE5iu/K0ESVFoYBA/XnEOLA/VyCTY,1oy,i,,'0,!!!;5,'siteVersion,'new;2,1,3ji,mf,,,'GET,5k,'c.go-mpulse.net:443,'/api/config.json,,1f,,3,!!!;5,4,5;2,1,49j,1e7,,,0,5m,1,'/api/even
2024-04-26 17:13:29 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:29 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760096-MIA
2024-04-26 17:13:29 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.5	50011	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:29 UTC	800	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=30028&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 7050 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:29 UTC	7050	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 62 34 4c 43 50 68 48 70 6c 6e 56 53 37 2f 7a 2f 46 59 46 30 30 48 71 30 36 34 59 73 77 2f 37 68 37 69 4c 62 45 35 69 75 2f 4b 30 45 53 56 46 6f 59 42 41 2f 58 6e 45 4f 4c 41 2f 56 79 43 54 59 22 2c 22 73 74 61 74 75 73 22 3a 32 30 31 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 31 39 34 7d 2c 22 72 Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/b4LCPhHplnVS7/z/FYF00Hq064Ysw/7h7iLbE5iu/K0ESVFoYBA/XnEOLA/VyCTY","status":201},"metrics":{"count":1,"txSize":{"t":2194},"r
2024-04-26 17:13:29 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:29 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760074-MIA
2024-04-26 17:13:29 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.5	50010	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:29 UTC	800	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=30029&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1197 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:29 UTC	1197	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 56 65 72 73 69 6f 6e 2f 31 2e 32 33 36 2e 30 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 4c 6f 61 64 65 72 54 79 70 65 2f 73 70 61 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 43 44 4e 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 Data Ascii: {"sm":[{"params":{"name":"Generic/Version/1.236.0/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/LoaderType/spa/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/DistMethod/CDN/Detected"},"stats":{"c":1}},{"params":{"name":"API/setCustomAttri
2024-04-26 17:13:29 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:29 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760065-MIA
2024-04-26 17:13:29 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.5	50013	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:29 UTC	797	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=30030&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 405 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:29 UTC	405	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 32 6d 6c 2c 31 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 65 2c 27 66 63 70 2c 32 6d 6c 2c 31 3b 35 2c 31 2c 32 3b 65 2c 27 70 61 67 65 48 69 64 65 2c 61 34 6d 2c 32 3b 36 2c 27 63 6c 73 2c 30 2e 31 30 30 37 30 32 36 39 32 30 30 33 31 36 37 30 36 3b 35 2c 31 2c 32 3b 65 2c 27 6c 6f 61 64 2c 66 70 32 2c 32 3b 36 2c 35 2c 30 2e 31 30 30 37 30 32 36 39 32 30 30 33 31 36 37 30 36 3b 35 2c 31 2c 32 3b 65 2c 27 6c 63 70 2c 33 39 33 2c 39 3b 36 2c 27 73 69 7a 65 2c 32 33 36 31 39 36 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 65 6c 55 72 6c 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 64 61 6d 2f 78 65 72 6f 2f 70 69 6c 6f 74 2d 69 6d 61 67 65 73 2f 66 65 61 74 75 72 Data Ascii: bel.6;e,'fp,2ml,1;5,'siteVersion,'new;e,'fcp,2ml,1;5,1,2;e,'pageHide,a4m,2;6,'cls,0.10070269200316706;5,1,2;e,'load,fp2,2;6,5,0.10070269200316706;5,1,2;e,'lcp,393,9;6,'size,236196.;5,'eid;5,'elUrl,'https://www.xero.com/content/dam/xero/pilot-images/featur
2024-04-26 17:13:29 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:29 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760080-MIA
2024-04-26 17:13:29 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.5	50019	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:29 UTC	836	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151608035&i=gtm&dwt=9671&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:29 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:29 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,fe6c8388aa27ca74f543329ef9497ca7,10.0.0.207,28200,102.129.152.220,,361521842025,1,1714151609.626,0.002,,.,0,0,0.000,0.000,-,0,0,203,182,91,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:29 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.5	50020	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:30 UTC	604	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151608035&i=gtm&dwt=9671&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:30 UTC	375	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:30 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,4a2d5fcf22b4fdf917917423b415bc7e,10.0.0.58,19714,102.129.152.220,,232876832746,1,1714151610.287,0.002,,.,0,0,0.000,0.000,-,0,0,203,156,78,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:30 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.5	50025	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:32 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151611504 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 401 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:32 UTC	401	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 31 31 35 30 33 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 68 61 73 68 3d 26 63 5f 68 6f 73 74 3d 77 77 77 2e 78 65 72 6f 2e 63 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151611503&d_rtbd=json&d_jsonv=1&d_dst=1&c_hash=&c_host=www.xero.co
2024-04-26 17:13:33 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:33 GMT Content-Type: application/json;charset=utf-8 Content-Length: 231 Connection: close X-TID: PDZaqV5UTGI= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-0ce7d0933.edge-usw2.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:33 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:33 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:33 UTC	231	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 50 44 5a 61 71 56 35 55 54 47 49 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"PDZaqV5UTGI="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.5	50030	63.140.39.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:32 UTC	608	OUT	OPTIONS /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: cache-control,pragma Origin: https://www.xero.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:33 UTC	694	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:33 GMT content-length: 0 vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers access-control-allow-origin: https://www.xero.com access-control-allow-methods: POST access-control-allow-headers: cache-control, pragma access-control-allow-credentials: true access-control-max-age: 1800 allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.5	50031	13.249.98.79	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:32 UTC	1188	OUT	GET /stats/TrustboxImpression?locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=4becd84a00006400050b6782&widgetId=53aa8912dec7e10d38f59f36 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:33 UTC	459	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Fri, 26 Apr 2024 17:13:32 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 55a2e492c74577abf8547dc740add63e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: Tg2v2P3uUW9MObyGGNvDfEwNBlNS0c4lW-bhQhde3-9J3bwIgA4eUw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.5	50039	63.140.39.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:33 UTC	734	OUT	POST /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive Content-Length: 374 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" pragma: no-cache sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain accept: / cache-control: no-cache sec-ch-ua-platform: "Windows" Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:33 UTC	374	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 68 61 6e 6e 65 6c 22 3a 22 77 65 62 22 2c 22 61 64 64 72 65 73 73 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 2f 22 2c 22 72 65 66 65 72 72 69 6e 67 55 72 6c 22 3a 22 22 7d 7d 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 78 70 65 72 69 65 6e 63 65 43 6c 6f 75 64 22 3a 7b 22 61 75 64 69 65 6e 63 65 Data Ascii: {"context":{"channel":"web","address":{"url":"https://www.xero.com/us/pricing-plans/","referringUrl":""}},"id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"experienceCloud":{"audience
2024-04-26 17:13:33 UTC	838	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:33 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://www.xero.com access-control-allow-credentials: true x-request-id: 45852c34-ff6b-4c65-8ba0-1723d3e4cb0b timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:13:33 UTC	355	IN	Data Raw: 31 35 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 35 38 62 63 35 38 33 37 2d 61 37 65 30 2d 34 33 35 36 2d 38 65 37 36 2d 66 37 63 61 62 38 66 31 39 32 32 37 22 2c 22 63 6c 69 65 6e 74 22 3a 22 78 65 72 6f 6c 69 6d 69 74 65 64 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 2e 33 34 5f 30 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 34 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 Data Ascii: 15c{"status":200,"requestId":"58bc5837-a7e0-4356-8e76-f7cab8f19227","client":"xerolimited","id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651.34_0","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"edgeHost":"mboxedge34.tt.omtrdc.net
2024-04-26 17:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.5	50041	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:33 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151611504 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:33 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:33 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: +GZktSYRSNU= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-06c1a6a8c.edge-va6.demdex.com 6 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:33 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:33 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:33 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.5	50040	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:33 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151611653 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 248 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:33 UTC	248	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 31 31 36 35 33 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 65 66 65 72 72 65 72 3d 6e 6f 74 2d 78 65 72 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151611653&d_rtbd=json&d_jsonv=1&d_dst=1&c_referrer=not-xero
2024-04-26 17:13:34 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:34 GMT Content-Type: application/json;charset=utf-8 Content-Length: 231 Connection: close X-TID: ra9NNX8+T2c= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-2-v056-089f708ee.edge-usw2.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:34 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:34 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:34 UTC	231	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 72 61 39 4e 4e 58 38 2b 54 32 63 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"ra9NNX8+T2c="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.5	50018	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:34 UTC	1220	OUT	GET /events.js HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:34 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:34 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=5
2024-04-26 17:13:34 UTC	3918	IN	Data Raw: 66 34 37 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 77 29 20 7b 0a 20 20 2f 2f 20 42 65 67 69 6e 20 64 6f 63 0a 0a 20 20 76 61 72 20 69 73 5f 64 65 76 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 66 61 6c 73 65 20 29 20 7b 0a 20 20 20 20 69 73 5f 64 65 76 20 3d 20 74 72 75 65 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 74 72 75 65 20 29 20 7b 0a 20 20 20 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 74 72 75 65 0a 20 20 7d 0a 0a 20 20 76 61 72 20 74 69 70 20 3d 20 22 4f 4f 39 5a 44 39 34 6d 64 39 66 56 41 77 47 73 58 54 76 5a 45 2d 6c 43 6f 64 4b 2d 4c 62 65 75 49 74 41 47 36 4f 35 44 38 64 6b 22 0a 20 20 0a 20 20 76 61 72 20 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 Data Ascii: f47(function (w) { // Begin doc var is_dev = false; if ( false ) { is_dev = true; } var disable_sync = false; if ( true ) { disable_sync = true } var tip = "OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk" var userIdCookieV
2024-04-26 17:13:34 UTC	14087	IN	Data Raw: 33 36 66 66 0d 0a 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 63 75 72 72 65 6e 74 5f 77 69 6e 64 6f 77 5f 75 72 6c 5f 70 61 72 61 6d 26 26 63 75 72 72 65 6e 74 5f 77 69 6e 64 6f 77 5f 75 72 6c 5f 70 61 72 61 6d 2e 69 6e 64 65 78 4f 66 28 67 6c 6f 62 61 6c 73 2e 73 61 5f 64 65 62 75 67 5f 6b 65 79 29 3e 2d 31 26 26 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 53 41 2f 52 54 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 4c 61 6c 28 65 29 7b 72 65 74 75 72 6e 20 6c 6f 61 64 4c 61 6c 48 65 6c 70 65 72 28 73 61 5f 75 72 6c 2c 65 29 2c 21 30 7d 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 4c 61 6c 48 65 6c 70 65 72 28 65 2c 6f 29 7b 76 61 72 20 74 3d 6e 65 77 20 49 6d 61 67 65 3b 72 65 73 3d 63 75 72 72 65 6e 74 4c 61 6e 64 69 6e 67 55 52 4c 28 29 3b 76 61 Data Ascii: 36ffdy.appendChild(t),current_window_url_param&&current_window_url_param.indexOf(globals.sa_debug_key)>-1&&console.log("SA/RT"))}function loadLal(e){return loadLalHelper(sa_url,e),!0}function loadLalHelper(e,o){var t=new Image;res=currentLandingURL();va
2024-04-26 17:13:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.5	50051	63.140.39.82	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:34 UTC	445	OUT	GET /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:34 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Fri, 26 Apr 2024 17:13:34 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:13:34 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-26 17:13:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.5	50053	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:34 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151611653 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:34 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:34 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: 4QsyJnRoSI8= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-0ce5556f7.edge-va6.demdex.com 7 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:34 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:34 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:34 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.5	50055	172.64.144.225	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:35 UTC	822	OUT	GET /attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/pricing-plans/&e=undefined HTTP/1.1 Host: tracking.g2crowd.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _session_id=eef7483c5c58c254b56a96a7aacb6ff9; __cf_bm=sKffacXb53u_QJt4jLSCYZ5Hq8Og8h0bozkWBVGAIL4-1714151591-1.0.1.1-QKEJfB.Abwc.0QYu8PDZbG2WISBQoAgaDNed3TqKHvvrftZet78EKg1uriE6VhQ0zGMrmeWxCCUg8.tXXAlN3Q
2024-04-26 17:13:36 UTC	1313	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:36 GMT Content-Type: text/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=600, public set-cookie: _session_id=eef7483c5c58c254b56a96a7aacb6ff9; path=/; expires=Fri, 10 May 2024 17:13:36 GMT; HttpOnly; secure; SameSite=None etag: W/"3dae93a05edd9dcfc1864b87178a31e0" x-request-id: 17151533-05fe-413e-8142-eb62ae713160 x-runtime: 0.003126 strict-transport-security: max-age=604800 x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block x-download-options: noopen x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin content-security-policy: default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a8344fdabcda57-MIA
2024-04-26 17:13:36 UTC	22	IN	Data Raw: 31 30 0d 0a 2f 2f 20 54 72 61 63 6b 69 6e 67 20 46 69 6c 65 0d 0a Data Ascii: 10// Tracking File
2024-04-26 17:13:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.5	50056	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:35 UTC	831	OUT	GET /up_loader.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUgASgDMgsIiJDDg92H8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE. If-None-Match: "d6f0435164aefe6cf324147b77c7b6bb" If-Modified-Since: Thu, 25 Apr 2024 19:49:47 GMT
2024-04-26 17:13:36 UTC	459	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 25 Apr 2024 19:52:55 GMT Last-Modified: Thu, 25 Apr 2024 19:49:47 GMT ETag: "d6f0435164aefe6cf324147b77c7b6bb" x-amz-server-side-encryption: AES256 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 8f716abb35818e2bd8a0134286c0945c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: DuOADZYIp4GCl03RQG3zA9AU_FrQ2OUCDeqC1sK8_wyUbuE8o0Dt-g== Age: 76841

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.5	50058	108.157.173.85	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:35 UTC	537	OUT	GET /c/hotjar-3197823.js?sv=6 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:36 UTC	632	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Fri, 26 Apr 2024 17:13:36 GMT Access-Control-Allow-Origin: * Cache-Control: max-age=60 Cross-Origin-Resource-Policy: cross-origin ETag: W/bfe92acfb0373750d6837a557751cf19 Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 27e533b5f5d5eefbbe949ec8ddb9a9e6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: 6nXs6pe2DkxVzjBSeiyz1silNQz8FKiFYNI_mqc-zqU5Inp650wpyw==
2024-04-26 17:13:36 UTC	8922	IN	Data Raw: 32 32 64 32 0d 0a 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 3d 20 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 7c 7c 20 7b 22 73 69 74 65 5f 69 64 22 3a 33 31 39 37 38 32 33 2c 22 72 65 63 5f 76 61 6c 75 65 22 3a 31 2e 30 2c 22 73 74 61 74 65 5f 63 68 61 6e 67 65 5f 6c 69 73 74 65 6e 5f 6d 6f 64 65 22 3a 22 61 75 74 6f 6d 61 74 69 63 22 2c 22 72 65 63 6f 72 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 69 6e 75 6f 75 73 5f 63 61 70 74 75 72 65 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 5f 63 61 70 74 75 72 65 5f 6b 65 79 73 74 72 6f 6b 65 73 22 3a 74 72 75 65 2c 22 73 65 73 73 69 6f 6e 5f 63 61 70 74 75 72 65 5f 63 6f 6e 73 6f 6c 65 5f 63 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 61 Data Ascii: 22d2window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":3197823,"rec_value":1.0,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":true,"session_capture_console_consent":false,"a
2024-04-26 17:13:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.5	50060	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:36 UTC	820	OUT	POST /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&page_title=Pricing%20Plans%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive Content-Length: 63 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151593\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:36 UTC	63	OUT	Data Raw: 7b 22 73 72 63 22 3a 22 74 61 67 22 2c 22 61 75 74 68 22 3a 22 42 47 43 53 44 6b 35 4c 45 48 4f 34 4d 50 56 70 67 44 52 4e 75 50 75 65 33 4d 4a 56 35 47 75 64 4d 31 70 30 45 49 42 6b 22 7d Data Ascii: {"src":"tag","auth":"BGCSDk5LEHO4MPVpgDRNuPue3MJV5GudM1p0EIBk"}
2024-04-26 17:13:37 UTC	951	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Content-Length: 3740 Connection: close Date: Fri, 26 Apr 2024 17:13:37 GMT Server: nginx Access-Control-Allow-Origin: https://www.xero.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: x-amz-cf-id Access-Control-Max-Age: 7200 Access-Control-Allow-Credentials: true Api-Version: v2 Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Identification-Source: CACHE Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 25 Apr 2024 17:13:37 GMT Vary: Accept-Encoding, Origin Request-ID: 1c7faa27-83b4-4b58-960b-5f53332a10bc X-Cache: Miss from cloudfront Via: 1.1 76f9985b0c929a023355db8e462592f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: 4aJtEKDZKBv3yPE95YUG6ZoLisJPuqL-9yvb2I4YPyORRRPSW44vAg==
2024-04-26 17:13:37 UTC	2096	IN	Data Raw: 7b 22 68 71 22 3a 7b 22 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 64 65 6d 61 6e 64 62 61 73 65 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 61 6c 69 61 73 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 69 6e 64 75 73 74 72 79 22 3a 22 42 75 73 69 6e 65 73 73 20 53 65 72 76 69 63 65 73 22 2c 22 73 75 62 5f 69 6e 64 75 73 74 72 79 22 3a 22 47 65 6e 65 72 61 6c 22 2c 22 65 6d 70 6c 6f 79 65 65 5f 63 6f 75 6e 74 22 3a 32 31 38 34 2c 22 70 72 69 6d 61 72 79 5f 73 69 63 22 3a 22 37 33 38 39 22 2c 22 70 72 69 6d 61 72 79 5f 6e 61 69 63 73 22 3a 6e 75 6c 6c 2c 22 73 74 72 65 65 74 5f 61 64 64 72 65 73 73 22 3a 22 35 39 35 20 53 20 38 30 20 45 20 53 74 65 20 33 30 30 22 2c 22 63 69 74 79 Data Ascii: {"hq":{"company_name":"Conservice","demandbase_sid":27340206,"marketing_alias":"Conservice","industry":"Business Services","sub_industry":"General","employee_count":2184,"primary_sic":"7389","primary_naics":null,"street_address":"595 S 80 E Ste 300","city
2024-04-26 17:13:37 UTC	1644	IN	Data Raw: 64 22 3a 32 37 33 34 30 32 30 36 2c 22 64 6f 6d 65 73 74 69 63 68 71 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 77 6f 72 6c 64 68 71 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 63 6f 6d 70 61 6e 79 5f 73 69 7a 65 22 3a 22 24 32 35 30 4d 20 2d 20 24 35 30 30 4d 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 6e 75 6c 6c 7d 2c 22 72 65 67 69 73 74 72 79 5f 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 4f 47 45 4e 54 2d 31 37 34 22 2c 22 72 65 67 69 73 74 72 79 5f 63 69 74 79 22 3a 22 4d 69 61 6d 69 22 2c 22 72 65 67 69 73 74 72 79 5f 73 74 61 74 65 22 3a 22 46 4c 22 2c 22 72 65 67 69 6f 6e 5f 6e 61 6d 65 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 72 65 67 69 73 74 72 79 5f 7a 69 70 5f 63 6f 64 65 22 3a 22 33 33 31 39 37 22 2c 22 72 65 67 69 73 74 72 79 Data Ascii: d":27340206,"domestichq_sid":27340206,"worldhq_sid":27340206,"company_size":"$250M - $500M","session_id":null},"registry_company_name":"COGENT-174","registry_city":"Miami","registry_state":"FL","region_name":"Florida","registry_zip_code":"33197","registry

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.5	50064	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:36 UTC	1386	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:37 UTC	1267	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:37 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.5	50068	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	3210	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:37 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 138 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:13:37 UTC	138	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.5	50069	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	3166	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9d [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:37 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:13:37 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.5	50062	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	1351	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:37 UTC	1232	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:37 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.5	50075	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	561	OUT	GET /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&page_title=Pricing%20Plans%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151593\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:37 UTC	491	IN	HTTP/1.1 401 Unauthorized Content-Type: text/plain;charset=utf-8 Content-Length: 12 Connection: close Date: Fri, 26 Apr 2024 17:13:37 GMT Server: nginx WWW-Authenticate: DemandBase API v2 X-Content-Type-Options: nosniff Request-ID: 931f55d9-56ae-4ce1-9f1b-301558629e16 Vary: Origin X-Cache: Error from cloudfront Via: 1.1 76f9985b0c929a023355db8e462592f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: GBvlbcWqVjprgIvzTehQ5U156ej6hSitmqVR4QpKM8tIB91hfXQtVw==
2024-04-26 17:13:37 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.5	50074	13.32.87.20	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	635	OUT	GET /bg9s?x-amz-cf-id=4aJtEKDZKBv3yPE95YUG6ZoLisJPuqL-9yvb2I4YPyORRRPSW44vAg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:37 UTC	578	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 b3ca1a7752327aa687a6611c7f28951e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: Ty4DOjP3ipfNBRKni9ny2zQ5gBGx9TVe_ENU1szTAHUOCJ0y6z57FA== Age: 71154 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.5	50078	151.101.65.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	910	OUT	GET /rp.gif?ts=1714151615059&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:37 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:37 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:37 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.5	50080	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	3012	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:38 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 138 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:13:38 UTC	138	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.5	50081	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	2968	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9d [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:38 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:13:38 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.5	50079	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:37 UTC	1420	OUT	GET /activityi;dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:38 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:38 GMT Expires: Fri, 26 Apr 2024 17:13:38 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:13:38 UTC	592	IN	Data Raw: 32 66 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4d 32 56 39 62 47 77 34 49 55 44 46 66 Data Ascii: 2f7<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CM2V9bGw4IUDFf
2024-04-26 17:13:38 UTC	174	IN	Data Raw: 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 70 73 63 64 6c 3d 6e 6f 61 70 69 3b 67 74 6d 3d 34 35 66 65 34 34 6f 30 7a 38 38 33 30 39 32 33 34 37 30 7a 61 32 30 31 3b 67 63 64 3d 31 33 6c 33 6c 33 6c 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>
2024-04-26 17:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.5	50084	146.75.124.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	625	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "bbbcf811d8437a575d796a4c1e5d4fad" If-Modified-Since: Thu, 04 Apr 2024 00:26:35 GMT
2024-04-26 17:13:38 UTC	339	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:13:38 GMT Cache-Control: no-cache ETag: "bbbcf811d8437a575d796a4c1e5d4fad" X-Served-By: cache-mia-kmia1760025-MIA X-Cache: HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.5	50066	34.96.71.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	782	OUT	GET /s/sync?exc=lr HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151593\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:38 UTC	510	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET,OPTIONS Content-Type: text/html; charset=UTF-8 Set-Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1714151618\|ix:0\|mctv:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Fri, 26 Apr 2024 17:13:38 GMT Content-Length: 74 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:38 UTC	74	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Pixels</title></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.5	50083	151.101.65.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	910	OUT	GET /rp.gif?ts=1714151615060&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:38 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:38 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.5	50088	13.32.87.128	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	437	OUT	GET /bg9s?x-amz-cf-id=4aJtEKDZKBv3yPE95YUG6ZoLisJPuqL-9yvb2I4YPyORRRPSW44vAg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:38 UTC	560	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 b6efbf009f233af7a7aa7da68e6e2848.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: 4AuaPNAWQ9H--v-rR9ZInTUB7_k_HDbVQsvvWxg4g9RscqrTZKoWUA== Age: 71155 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.5	50082	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	1385	OUT	GET /activityi;dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:38 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:38 GMT Expires: Fri, 26 Apr 2024 17:13:38 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:13:38 UTC	592	IN	Data Raw: 32 64 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4b 47 34 69 62 4b 77 34 49 55 44 46 64 Data Ascii: 2d4<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CKG4ibKw4IUDFd
2024-04-26 17:13:38 UTC	139	IN	Data Raw: 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 6d 61 74 63 68 5f 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>
2024-04-26 17:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.5	50086	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	685	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:38 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:38 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,a1502679b06b76792428cfe01845f1f0,10.0.0.207,48932,102.129.152.220,,232876885193,1,1714151618.410,0.006,,.,0,0,0.000,0.004,-,0,0,203,123,61,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.5	50087	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	1350	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:38 UTC	2222	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"18367842609021074684","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_ty [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.5	50089	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	1315	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:38 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"15614512977393639223","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.5	50092	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	678	OUT	GET /rp.gif?ts=1714151615059&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:38 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:38 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.5	50090	52.95.115.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	652	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151616852 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:13:38 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:13:38 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: QGXD7Q81M5AFTAYF1SZQ Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:13:38 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:13:38 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:13:38 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.5	50094	35.174.127.31	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	679	OUT	GET /pubsub/5-lply-f-VjGB-pLga11-efp0LSssuhSSwqyxVV9fMRaPOythrtG38Y2wFjZt7qmHSjq8ooW0zEhuw-bic1WNA-W0izXHhxBNjx1bP?X-Nexus-New-Client=true&X-Nexus-Version=0.12.12&user_role=visitor HTTP/1.1 Host: nexus-websocket-a.intercom.io Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://in.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: lVNoc6gPVvDl3mfAEQbknw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.5	50095	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	1211	OUT	GET /ddm/fls/z/dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:38 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.5	50096	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	678	OUT	GET /rp.gif?ts=1714151615060&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:38 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:38 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.5	50097	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	453	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:39 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,1992b998e0927fd0dff0ba8d406bb7ca,10.0.0.58,55770,102.129.152.220,,232623543921,1,1714151619.067,0.002,,.,0,0,0.000,0.004,-,0,0,203,268,134,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:39 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.5	50098	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	1176	OUT	GET /ddm/fls/z/dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.5	50100	68.67.179.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	745	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151615355&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&st=1714151615355&et=1714151615355&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:39 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:13:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.5	50101	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	673	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=DFeChJjoe3vyUcnXWaAUEVHnwUo1Dv8b0T3g6ZSscPc=; pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA
2024-04-26 17:13:39 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=RAMEhgMp/3XjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:13:39 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:13:39 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:13:39 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.5	50104	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:38 UTC	1063	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:39 UTC	2222	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"18367842609021074684","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_ty [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.5	50099	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	1028	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:39 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"15614512977393639223","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.5	50106	192.178.50.38	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 38 33 36 37 38 34 32 36 30 39 30 32 31 30 37 34 36 38 34 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"18367842609021074684"},"type":"trigger-no-matching-source"}]
2024-04-26 17:13:39 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:13:39 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.5	50105	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	885	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A35%20GMT&n=-2d&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:13:39 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:39 GMT Expires: Fri, 26 Apr 2024 17:13:39 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:13:39 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:13:39 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.5	50107	142.250.189.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 35 36 31 34 35 31 32 39 37 37 33 39 33 36 33 39 32 32 33 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"15614512977393639223"},"type":"trigger-no-matching-source"}]
2024-04-26 17:13:39 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:13:39 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.5	50110	18.173.166.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	688	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151616852 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Attribution-Reporting-Eligible: trigger;event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:13:39 GMT x-amzn-RequestId: 1a458868-1a43-43d3-8481-3c3d2768465a Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Access-Control-Allow-Credentials: true X-Cache: Miss from cloudfront Via: 1.1 1da0abf50a5fdf7ae338fbc8547b31e6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: uUa3JmvaCwRRmbLRWZ5ydxA_y_GfCt_vjqFVSRhSOaxT1C24XGqMSg==
2024-04-26 17:13:39 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.5	50109	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	868	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616830&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=1, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:39 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.5	50113	13.226.52.60	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	544	OUT	GET /modules.25f289cf2c430c5f1dfb.js HTTP/1.1 Host: script.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	718	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 225866 Connection: close Date: Thu, 25 Apr 2024 13:00:16 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "b89693e18ed17f9b649ddaf638e17a57" Last-Modified: Thu, 25 Apr 2024 12:59:19 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 81148d596ccabdf71245563094108fbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 X-Amz-Cf-Id: JMjbQ62NiixvOKkLosQoP3ukD2XkbpZqJ0F3WgSavgqglYiImpQ68w== Age: 101603
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 6f 64 75 6c 65 73 2e 32 35 66 32 38 39 63 66 32 63 34 33 30 63 35 66 31 64 66 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 34 37 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 72 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 49 44 45 4e 54 49 46 59 5f 55 53 45 52 3a 22 69 64 65 6e 74 69 66 79 5f 75 73 65 72 22 2c 41 55 54 4f 54 41 47 5f 52 45 43 4f 52 44 49 4e 47 3a 22 61 75 74 6f 74 61 67 5f 72 65 63 6f Data Ascii: /! For license information please see modules.25f289cf2c430c5f1dfb.js.LICENSE.txt /!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_reco
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 75 72 6e 7b 66 65 65 64 62 61 63 6b 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 74 6a 61 72 2e 63 6f 6d 2f 69 6e 63 6f 6d 69 6e 67 2d 66 65 65 64 62 61 63 6b 3f 22 2b 22 75 74 6d 5f 73 6f 75 72 63 65 3d 63 6c 69 65 6e 74 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 69 6e 63 6f 6d 69 6e 67 5f 66 65 65 64 62 61 63 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 69 6e 73 69 67 68 74 73 26 70 72 65 76 3d 22 2e 63 6f 6e 63 61 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2c 70 6f 6c 6c 73 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 74 6a 61 72 2e 63 6f 6d 2f 66 65 65 64 62 61 63 6b 2d 73 75 72 76 65 79 73 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 63 6c 69 65 6e 74 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 70 6f 6c 6c 26 75 74 6d 5f 63 61 6d 70 61 69 67 Data Ascii: urn{feedback:"https://www.hotjar.com/incoming-feedback?"+"utm_source=client&utm_medium=incoming_feedback&utm_campaign=insights&prev=".concat(window.location.href),polls:"https://www.hotjar.com/feedback-surveys?utm_source=client&utm_medium=poll&utm_campaig
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 61 28 22 48 75 62 53 70 6f 74 20 73 65 74 75 70 20 73 74 61 72 74 65 64 22 29 2c 28 30 2c 72 2e 50 59 29 28 69 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 7b 76 61 72 20 74 3d 68 6a 2e 62 72 69 64 67 65 2e 73 74 6f 72 61 67 65 2e 69 74 65 6d 73 2e 48 55 42 53 50 4f 54 5f 55 54 4b 2e 67 65 74 28 29 3b 61 28 22 48 75 62 53 70 6f 74 20 55 54 4b 20 66 6f 75 6e 64 3a 20 22 2e 63 6f 6e 63 61 74 28 74 29 29 2c 68 6a 2e 65 76 65 6e 74 2e 73 69 67 6e 61 6c 28 22 69 6e 74 2e 68 75 62 73 70 6f 74 22 2c 7b 75 74 6b 3a 74 7d 29 7d 65 6c 73 65 20 61 28 22 48 75 62 53 70 6f 74 20 55 54 4b 20 63 6f 6f 6b 69 65 20 6e 6f 74 20 66 6f 75 6e 64 22 29 7d 29 2c 35 65 33 2c 35 29 7d 29 2c 22 68 75 62 73 70 6f 74 2e 73 65 74 75 70 22 29 7d 7d 2c 36 31 37 35 3a 66 75 Data Ascii: a("HubSpot setup started"),(0,r.PY)(i,(function(e){if(e){var t=hj.bridge.storage.items.HUBSPOT_UTK.get();a("HubSpot UTK found: ".concat(t)),hj.event.signal("int.hubspot",{utk:t})}else a("HubSpot UTK cookie not found")}),5e3,5)}),"hubspot.setup")}},6175:fu
2024-04-26 17:13:39 UTC	1239	IN	Data Raw: 6c 61 73 73 65 73 3a 21 30 2c 6d 61 78 43 6c 61 73 73 65 73 41 6c 6c 6f 77 65 64 3a 35 2c 64 69 73 61 6c 6c 6f 77 65 64 54 61 67 4e 61 6d 65 43 68 61 72 61 63 74 65 72 73 52 45 3a 2f 5b 5e 61 2d 7a 41 2d 5a 30 2d 39 2d 5f 5d 2f 67 7d 7d 2c 70 3d 7b 32 3a 65 28 65 28 7b 7d 2c 67 5b 32 5d 29 2c 7b 7d 2c 7b 67 65 74 46 75 6c 6c 53 65 6c 65 63 74 6f 72 3a 21 30 7d 29 7d 3b 68 6a 2e 73 65 6c 65 63 74 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 61 5b 65 3d 21 65 7c 7c 65 3c 32 3f 32 3a 65 5d 7c 7c 28 61 5b 65 5d 3d 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 28 74 2c 67 5b 65 5d 29 7d 2c 63 6c 65 61 72 4d 61 74 63 68 69 6e 67 45 6c 65 6d 65 6e 74 73 43 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 63 3d 7b Data Ascii: lasses:!0,maxClassesAllowed:5,disallowedTagNameCharactersRE:/[^a-zA-Z0-9-_]/g}},p={2:e(e({},g[2]),{},{getFullSelector:!0})};hj.selector=function(e){return a[e=!e\|\|e<2?2:e]\|\|(a[e]={get:function(t){return f(t,g[e])},clearMatchingElementsCache:function(){c={
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 6f 67 2e 64 65 62 75 67 28 27 55 6e 6b 6e 6f 77 6e 20 63 6f 6d 6d 61 6e 64 3a 20 22 27 2b 65 5b 30 5d 2b 27 22 27 2c 22 63 6f 6d 6d 61 6e 64 22 29 2c 6e 2e 6c 65 6e 67 74 68 3e 30 26 26 68 6a 2e 74 72 79 43 61 74 63 68 28 63 29 28 29 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 29 7b 65 5b 30 5d 26 26 68 6a 2e 65 76 65 6e 74 2e 73 69 67 6e 61 6c 28 22 74 72 69 67 67 65 72 3a 22 2b 65 5b 30 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 69 66 28 65 5b 30 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 30 5d 29 29 7b 76 61 72 20 74 3d 68 6a 2e 70 72 69 76 61 63 79 2e 67 65 74 54 61 67 73 57 69 74 68 6f 75 74 50 49 49 28 65 5b 30 5d 29 3b 68 6a 2e 62 65 68 61 76 69 6f 72 44 61 74 61 2e 74 61 67 52 65 63 6f 72 64 69 6e 67 28 74 29 7d 65 6c 73 65 20 68 Data Ascii: og.debug('Unknown command: "'+e[0]+'"',"command"),n.length>0&&hj.tryCatch(c)()}function u(e){e[0]&&hj.event.signal("trigger:"+e[0])}function l(e){if(e[0]&&Array.isArray(e[0])){var t=hj.privacy.getTagsWithoutPII(e[0]);hj.behaviorData.tagRecording(t)}else h
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 74 53 65 73 73 69 6f 6e 55 73 65 72 49 64 3a 69 2e 62 4e 2c 67 65 74 53 65 73 73 69 6f 6e 46 69 72 73 74 53 65 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 2e 51 2e 67 65 74 28 22 73 65 73 73 69 6f 6e 2e 66 69 72 73 74 53 65 65 6e 22 29 7d 2c 67 65 74 50 61 67 65 43 6f 6e 74 65 6e 74 3a 68 6a 2e 68 74 6d 6c 2e 67 65 74 50 61 67 65 43 6f 6e 74 65 6e 74 2c 66 6c 75 73 68 55 73 65 72 41 74 74 72 69 62 75 74 65 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 72 2e 6c 2e 69 73 52 65 63 6f 72 64 69 6e 67 45 6e 61 62 6c 65 64 28 29 29 7b 76 61 72 20 6e 3d 7b 68 6a 5f 69 64 3a 28 30 2c 69 2e 62 4e 29 28 21 30 29 2c 75 73 65 72 5f 69 64 3a 65 2c 61 74 74 72 69 62 75 74 65 73 3a 74 2c 74 69 6d 65 3a 68 6a 2e 74 69 6d 65 2e 67 65 74 4e Data Ascii: tSessionUserId:i.bN,getSessionFirstSeen:function(){return o.Q.get("session.firstSeen")},getPageContent:hj.html.getPageContent,flushUserAttributes:function(e,t){if(r.l.isRecordingEnabled()){var n={hj_id:(0,i.bN)(!0),user_id:e,attributes:t,time:hj.time.getN
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 45 44 5f 49 4e 29 7b 76 61 72 20 69 3d 4b 2e 53 54 41 59 45 44 5f 49 4e 3b 6e 26 26 6e 2e 63 68 69 6c 64 4c 69 73 74 26 26 28 6e 2e 6f 6c 64 50 61 72 65 6e 74 4e 6f 64 65 21 3d 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 28 69 3d 4b 2e 52 45 50 41 52 45 4e 54 45 44 2c 6f 2e 65 6e 73 75 72 65 48 61 73 4f 6c 64 50 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 49 66 4e 65 65 64 65 64 28 65 29 29 3a 6f 2e 77 61 73 52 65 6f 72 64 65 72 65 64 28 65 29 26 26 28 69 3d 4b 2e 52 45 4f 52 44 45 52 45 44 29 29 2c 6f 2e 73 74 61 79 65 64 49 6e 2e 73 65 74 28 65 2c 69 29 7d 69 66 28 72 21 3d 3d 4b 2e 53 54 41 59 45 44 5f 49 4e 29 66 6f 72 28 76 61 72 20 61 3d 65 2e 66 69 72 73 74 43 68 69 6c 64 3b 61 3b 61 3d 61 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 6f 2e 76 69 73 69 74 4e Data Ascii: ED_IN){var i=K.STAYED_IN;n&&n.childList&&(n.oldParentNode!==e.parentNode?(i=K.REPARENTED,o.ensureHasOldPreviousSiblingIfNeeded(e)):o.wasReordered(e)&&(i=K.REORDERED)),o.stayedIn.set(e,i)}if(r!==K.STAYED_IN)for(var a=e.firstChild;a;a=a.nextSibling)o.visitN
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 72 3d 74 5b 6e 5d 3b 72 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 72 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 72 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 72 26 26 28 72 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 76 65 28 72 2e 6b 65 79 29 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 65 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 26 26 67 65 28 65 2e 70 72 6f 74 6f 74 79 70 65 2c 74 29 2c 6e 26 26 67 65 28 65 2c 6e 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 76 65 28 65 29 7b 76 61 72 20 74 3d 66 Data Ascii: r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,ve(r.key),r)}}function pe(e,t,n){return t&&ge(e.prototype,t),n&&ge(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}function ve(e){var t=f
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 2e 68 71 2e 61 6a 61 78 28 7b 75 72 6c 3a 65 2c 73 75 63 63 65 73 73 3a 68 6a 2e 74 72 79 43 61 74 63 68 28 74 2c 22 44 61 74 61 22 29 2c 65 72 72 6f 72 3a 68 6a 2e 74 72 79 43 61 74 63 68 28 6e 2c 22 44 61 74 61 22 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 6f 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 34 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 34 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 34 5d 3a 7b 63 6f 6e 74 65 6e 74 54 79 70 65 3a 22 6a 73 6f 6e 22 7d 3b 6e 3d 6e 7c 7c 68 6a 2e 68 71 2e 6e 6f 6f 70 2c 72 3d 72 7c 7c 68 6a 2e 68 71 2e 6e 6f 6f 70 3b 76 61 72 20 69 3d 6e 75 6c 6c 21 3d 6f 26 26 6f 2e 71 75 65 72 79 3f 22 22 2e 63 6f 6e 63 61 74 28 65 2c 22 3f 22 29 2e 63 6f 6e 63 61 Data Ascii: .hq.ajax({url:e,success:hj.tryCatch(t,"Data"),error:hj.tryCatch(n,"Data")})}function o(e,t,n,r){var o=arguments.length>4&&void 0!==arguments[4]?arguments[4]:{contentType:"json"};n=n\|\|hj.hq.noop,r=r\|\|hj.hq.noop;var i=null!=o&&o.query?"".concat(e,"?").conca
2024-04-26 17:13:39 UTC	16384	IN	Data Raw: 74 2e 6b 65 79 73 28 65 29 2e 73 6f 6d 65 28 43 29 7d 29 29 7d 3b 72 65 74 75 72 6e 20 74 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 70 61 67 65 56 69 73 69 74 4b 65 79 3a 65 7c 7c 70 7d 3b 53 2e 65 76 65 6e 74 73 2e 70 75 73 68 28 74 29 7d 29 2c 22 64 61 74 61 22 29 2c 6e 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 6e 3d 53 2e 65 76 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 6f 3d 5b 5d 2c 69 3d 5b 5d 2c 61 3d 30 3b 61 3c 6e 3b 61 2b 2b 29 69 66 28 65 3d 53 2e 65 76 65 6e 74 73 5b 61 5d 2c 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 2e 6c 65 6e 67 74 68 3e 31 29 7b 76 61 72 20 73 3d 5b 5d 3b 65 2e 61 75 74 6f 74 61 67 5f 72 65 63 6f Data Ascii: t.keys(e).some(C)}))};return t=hj.tryCatch((function(e){var t={pageVisitKey:e\|\|p};S.events.push(t)}),"data"),n=hj.tryCatch((function(){for(var e,n=S.events.length,r=[],o=[],i=[],a=0;a<n;a++)if(e=S.events[a],Object.keys(e).length>1){var s=[];e.autotag_reco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.5	50111	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	964	OUT	GET /ddm/fls/z/dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.5	50115	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	960	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616830&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:39 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:39 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:13:39 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.5	50112	67.220.224.144	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	481	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151616852 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:13:40 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:13:40 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: BXWYB5XAPWG38EV2EV8D Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:13:40 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:13:40 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:13:40 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.5	50118	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	897	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616834&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:39 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3404, tp=-1, tpl=-1, uplat=1, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:39 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.5	50116	68.67.160.75	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	513	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151615355&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&st=1714151615355&et=1714151615355&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:39 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:13:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.5	50121	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	989	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616834&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:40 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:40 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:13:40 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.5	50119	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	929	OUT	GET /ddm/fls/z/dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.5	50122	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	636	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616830&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:39 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.5	50126	18.173.166.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	436	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151616852 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	378	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:13:40 GMT x-amzn-RequestId: 4fb06973-14f6-4a90-8ec4-c4e99cefa584 X-Cache: Miss from cloudfront Via: 1.1 b3022b7a8efd08934ce14d0556eaed52.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: T8MYG5L9lEYBucCEFMcAR0FJyVVRHBEQX5tZwOYoqH2zsiarn83lMQ==
2024-04-26 17:13:40 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.5	50120	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	441	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=RAMEhgMp/3XjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:13:40 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=bjCab9J/0tvjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:13:40 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:13:40 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:13:40 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.5	50123	104.244.42.69	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	981	OUT	GET /i/adsct?bci=3&eci=2&event_id=c0a7f275-8ee5-4eff-b308-45e5b930215a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2af1c565-cd9f-4f71-a2fe-91fcaff0e80b&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:13:40 UTC	392	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:39 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 65683399bca79b61 strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: 450cc5df77f1c8915689972f40e5a49eccd4429948516ecda84d236c6b142fd9 connection: close
2024-04-26 17:13:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.5	50117	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	653	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A35%20GMT&n=-2d&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:13:40 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:39 GMT Expires: Fri, 26 Apr 2024 17:13:39 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:13:39 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.5	50124	104.244.42.195	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	1002	OUT	GET /i/adsct?bci=3&eci=2&event_id=c0a7f275-8ee5-4eff-b308-45e5b930215a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2af1c565-cd9f-4f71-a2fe-91fcaff0e80b&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:13:40 UTC	400	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:40 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: b2c1a0f0c306e57a strict-transport-security: max-age=631138519 x-response-time: 8 x-connection-hash: ef37142255788bd4f9f054b33bffc5c3482e2c752433bafe1a68857dcfc19234 connection: close
2024-04-26 17:13:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.5	50125	192.184.68.234	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:39 UTC	1365	OUT	GET /pixel;r=495951217;labels=_fp.event.Plans;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151617656;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Pricing%20Plans%2Cdescription.Find%20a%20Xero%20pricing%20plan%20to%20suit%20your%20business%252E%20All%20plans%20cover%20the%20accounting%20e%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Fpricing-plans%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=9ec0895f-9052-4066-9f64-825f06d352a3;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993
2024-04-26 17:13:40 UTC	475	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:40 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=EOcBBgHaKw; expires=Thu, 25-Jul-2024 17:13:40 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400
2024-04-26 17:13:40 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.5	50129	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	665	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616834&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3404, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.5	50130	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	673	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616830&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:40 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:40 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.5	50131	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	702	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151616834&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:40 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:40 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.5	50132	104.244.42.197	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	749	OUT	GET /i/adsct?bci=3&eci=2&event_id=c0a7f275-8ee5-4eff-b308-45e5b930215a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2af1c565-cd9f-4f71-a2fe-91fcaff0e80b&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:13:40 UTC	393	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:40 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 92725b57e9c34549 strict-transport-security: max-age=0 x-response-time: 84 x-connection-hash: 45fa3d9d7200d3fda7335f02ec58d353f8b9cf55569602b8e2153851eecd36fe connection: close
2024-04-26 17:13:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.5	50134	104.244.42.67	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	770	OUT	GET /i/adsct?bci=3&eci=2&event_id=c0a7f275-8ee5-4eff-b308-45e5b930215a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2af1c565-cd9f-4f71-a2fe-91fcaff0e80b&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:13:40 UTC	400	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:39 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: b0fb18b9d7fa5fb2 strict-transport-security: max-age=631138519 x-response-time: 5 x-connection-hash: 961324ab5b278cf010d3f936c15b125ba8bed7053beb1d747b8d2ec8b3c56171 connection: close
2024-04-26 17:13:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.5	50135	192.184.68.234	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	1147	OUT	GET /pixel;r=495951217;labels=_fp.event.Plans;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151617656;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Pricing%20Plans%2Cdescription.Find%20a%20Xero%20pricing%20plan%20to%20suit%20your%20business%252E%20All%20plans%20cover%20the%20accounting%20e%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Fpricing-plans%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=9ec0895f-9052-4066-9f64-825f06d352a3;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:13:40 UTC	354	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:40 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:13:40 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.5	50133	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: ynzbt0HTVIS8JAL8arreHA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:13:41 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:13:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:13:41 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.5	50137	142.250.217.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	1663	OUT	GET /pagead/1p-conversion/1023673485/?random=524713877&cv=11&fst=1714151615717&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSixub3QtbmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXIsIGV2ZW50LXNvdXJjZWIECgICAw&pscrd=COSJ4tK3rsedVSITCJen7LKw4IUDFbSLgwgd8TMJPTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLOhVodHRwczovL3d3dy54ZXJvLmNvbS8&is_vtc=1&cid=CAQSKQB7FLtq-pSgiRZE3I33229TmaYcdc3QqlCnMOPFLHo__Rk0X3xZKUCz&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaHz5rrz6HTQj-NVBfn9JF3Vl6fgxQcNa2w&random=2159176943 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.5	50136	54.154.35.245	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:40 UTC	627	OUT	POST /?site_id=3197823&gzip=1 HTTP/1.1 Host: content.hotjar.io Connection: keep-alive Content-Length: 32623 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain; charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:40 UTC	16384	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a ec bd eb 76 db 48 96 2e f8 2a 18 cf 29 57 b7 c7 a4 10 77 44 f6 78 6a 6c fa a6 4c df d2 92 33 d3 9e 3a cb 0b 24 41 09 16 49 d0 00 a8 8b 7b 7a ad 7e 87 f9 75 fe 9d bf f3 1a f3 28 fd 24 b3 77 80 a4 08 81 14 03 12 00 ca 36 5d 59 14 83 08 44 ec b8 ec 4b ec d8 f1 c5 bf df eb 47 bd c3 8b 49 70 ef 97 7b ff fb ff f2 f4 6d e7 f0 e3 bb 67 ce 71 3a 1a fe 1f ff 1c df 7b 78 2f 8e a2 74 bf 7f ef 17 f2 f0 5e ef 38 1c f6 e3 60 7c ef 97 ff eb df ef 8d a3 7e 90 bd 46 dc 87 f7 42 c8 41 1f de 1b fb 23 2c 07 df 86 57 27 d3 ee 30 ec e1 cb f7 20 95 5c 24 69 30 ca 52 ff f1 30 57 40 f6 3e 7b 78 2f f5 8f de 64 45 bc 3c 7c fd 0a 5e f2 d3 34 0e bb d3 34 48 ee fd f2 ef f7 86 fe f8 08 9e 01 05 ff 31 a3 e6 0d 14 92 5c a5 27 2b 8e e7 8a 7b f6 f8 e9 d5 e2 2c Data Ascii: vH.*)WwDxjlL3:$AI{z~u($w6]YDKGIp{mgq:{x/t^8`\|~FBA#,W'0 \$i0R0W@>{x/dE<\|^44H1\'+{,
2024-04-26 17:13:40 UTC	16239	OUT	Data Raw: 6d cb b9 a9 68 c5 ce cd 3a a5 9a 9d 73 b3 56 a9 56 de bb e9 d5 e0 dd 2c a2 9c 6c 94 6a cc d2 bb f9 83 4a 35 66 79 b6 fd 07 97 6a ac c9 13 e9 8a 6d eb 44 ba 62 df cd 89 74 6f fb 2e 59 56 fe 44 ba 57 83 4b 96 95 3e 91 ae d8 ee 44 7a 2d 2e 59 d6 ec 89 74 c5 b7 77 22 5d f1 ad 9c 48 57 7c bb 27 d2 15 df da 89 74 c5 77 27 d2 17 5d b1 3b 91 fe 13 b9 64 f9 ee 44 fa aa 5e d9 ea 89 74 c5 ef ca 89 74 c5 0b 27 d2 0f 63 bf 77 e2 4c e2 e8 4b d0 4b 37 7b 62 c5 ed 8f a5 97 f0 59 e4 a1 5c 9a b4 ee 45 c5 c7 d2 eb f3 59 e8 3b e0 89 15 e5 cf a5 eb 1a 3c b1 a2 70 2e 7d a3 cf a2 04 5e cb 8f e8 b3 b0 06 30 f9 b1 7d 16 e2 f6 28 9b 65 a4 da b6 50 36 95 a8 18 65 b3 4e a9 b6 7d 4f ac 2c 0f b3 a9 6b f0 c4 ca 02 cc e6 46 a9 26 6d 5d 91 3f a6 54 cb c3 a4 fc b4 52 4d 36 79 8b 90 92 db Data Ascii: mh:sVV,ljJ5fyjmDbto.YVDWK>Dz-.Ytw"]HW\|'tw'];dD^tt'cwLKK7{bY\EY;<p.}^0}(eP6eN}O,kF&m]?TRM6y
2024-04-26 17:13:41 UTC	190	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:41 GMT Content-Type: application/json Content-Length: 56 Connection: close Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400
2024-04-26 17:13:41 UTC	56	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 5f 75 75 69 64 22 3a 22 65 49 62 6b 70 6b 50 30 51 54 79 50 79 50 50 66 79 4e 30 75 76 51 22 2c 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d Data Ascii: {"content_uuid":"eIbkpkP0QTyPyPPfyN0uvQ","success":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.5	50141	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:41 UTC	1110	OUT	POST /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=12336&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/&af=err,xhr,stn,ins,spa&be=576&fe=11713&dc=2765&perf=%7B%22timing%22:%7B%22of%22:1714151608024,%22n%22:0,%22f%22:4,%22dn%22:26,%22dne%22:26,%22c%22:26,%22s%22:27,%22ce%22:291,%22rq%22:292,%22rp%22:576,%22rpe%22:1234,%22di%22:3265,%22ds%22:3341,%22de%22:3342,%22dc%22:12279,%22l%22:12282,%22le%22:12289%7D,%22navigation%22:%7B%7D%7D&fp=1025&fcp=1025 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 28 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:41 UTC	28	OUT	Data Raw: 7b 22 6a 61 22 3a 7b 22 73 69 74 65 56 65 72 73 69 6f 6e 22 3a 22 6e 65 77 22 7d 7d Data Ascii: {"ja":{"siteVersion":"new"}}
2024-04-26 17:13:42 UTC	436	IN	HTTP/1.1 200 Connection: close Content-Length: 151 date: Fri, 26 Apr 2024 17:13:41 GMT content-type: text/plain cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com access-control-expose-headers: Date timing-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760076-MIA
2024-04-26 17:13:42 UTC	151	IN	Data Raw: 7b 22 73 74 6e 22 3a 30 2c 22 65 72 72 22 3a 31 2c 22 69 6e 73 22 3a 31 2c 22 73 70 61 22 3a 31 2c 22 73 72 22 3a 30 2c 22 73 72 73 22 3a 30 2c 22 73 74 22 3a 30 2c 22 73 74 73 22 3a 30 2c 22 61 70 70 22 3a 7b 22 61 67 65 6e 74 73 22 3a 5b 7b 22 65 6e 74 69 74 79 47 75 69 64 22 3a 22 4d 54 6b 32 4d 6a 41 78 4e 33 78 43 55 6b 39 58 55 30 56 53 66 45 46 51 55 45 78 4a 51 30 46 55 53 55 39 4f 66 44 45 77 4d 6a 4d 7a 4f 44 55 78 4e 6a 41 22 7d 5d 7d 7d Data Ascii: {"stn":0,"err":1,"ins":1,"spa":1,"sr":0,"srs":0,"st":0,"sts":0,"app":{"agents":[{"entityGuid":"MTk2MjAxN3xCUk9XU0VSfEFQUExJQ0FUSU9OfDEwMjMzODUxNjA"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.5	50139	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:41 UTC	1431	OUT	GET /pagead/1p-conversion/1023673485/?random=524713877&cv=11&fst=1714151615717&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSixub3QtbmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXIsIGV2ZW50LXNvdXJjZWIECgICAw&pscrd=COSJ4tK3rsedVSITCJen7LKw4IUDFbSLgwgd8TMJPTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLOhVodHRwczovL3d3dy54ZXJvLmNvbS8&is_vtc=1&cid=CAQSKQB7FLtq-pSgiRZE3I33229TmaYcdc3QqlCnMOPFLHo__Rk0X3xZKUCz&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaHz5rrz6HTQj-NVBfn9JF3Vl6fgxQcNa2w&random=2159176943 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:42 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.5	50140	15.197.193.217	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:41 UTC	1021	OUT	GET /track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: insight.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFGAUgASgDMgsIiJDDg92H8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.
2024-04-26 17:13:41 UTC	629	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:41 GMT Content-Type: text/html Content-Length: 931 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:41 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsIrKHykciH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSgDMgsIhPP0vt6H8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:13:41 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:41 UTC	931	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 61 64 73 72 76 72 2e 6f 72 67 2f 75 6e 69 76 65 72 73 61 6c 5f 70 69 78 65 6c 2e 31 2e 31 2e 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 75 6e 69 76 65 72 73 61 6c 50 69 78 65 6c 43 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 6c 6f 62 61 6c 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <html><head> <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script></head><body> <div id="universalPixelContainer"> <script type="text/javascript"> (function(global) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.5	50142	54.154.35.245	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:42 UTC	364	OUT	GET /?site_id=3197823&gzip=1 HTTP/1.1 Host: content.hotjar.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:43 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:13:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 11 Connection: close
2024-04-26 17:13:43 UTC	11	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.5	50143	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:42 UTC	771	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=13064&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 2334 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:42 UTC	2334	OUT	Data Raw: 62 65 6c 2e 37 3b 31 2c 74 2c 2c 61 32 72 2c 39 78 61 2c 63 37 2c 27 69 6e 69 74 69 61 6c 50 61 67 65 4c 6f 61 64 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 2f 2c 31 2c 31 2c 2c 2c 21 21 21 21 27 39 30 65 62 62 32 38 32 2d 35 64 61 62 2d 34 33 61 62 2d 61 36 64 32 2d 33 66 31 32 38 37 33 35 64 37 61 32 2c 27 31 2c 73 68 2c 73 68 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 2c 32 71 6b 2c 32 77 2c 37 2c 31 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 31 31 2c 21 21 21 3b 32 2c 2c 32 71 75 2c 33 31 2c 36 2c Data Ascii: bel.7;1,t,,a2r,9xa,c7,'initialPageLoad,'https://www.xero.com/us/pricing-plans/,1,1,,,!!!!'90ebb282-5dab-43ab-a6d2-3f128735d7a2,'1,sh,sh;5,'siteVersion,'new;2,,2qk,2w,7,1,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'11,!!!;2,,2qu,31,6,
2024-04-26 17:13:42 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:42 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760050-MIA
2024-04-26 17:13:42 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.5	50144	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:42 UTC	865	OUT	GET /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=12336&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/&af=err,xhr,stn,ins,spa&be=576&fe=11713&dc=2765&perf=%7B%22timing%22:%7B%22of%22:1714151608024,%22n%22:0,%22f%22:4,%22dn%22:26,%22dne%22:26,%22c%22:26,%22s%22:27,%22ce%22:291,%22rq%22:292,%22rp%22:576,%22rpe%22:1234,%22di%22:3265,%22ds%22:3341,%22de%22:3342,%22dc%22:12279,%22l%22:12282,%22le%22:12289%7D,%22navigation%22:%7B%7D%7D&fp=1025&fcp=1025 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:42 UTC	396	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:13:42 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * x-served-by: cache-mia-kmia1760031-MIA
2024-04-26 17:13:42 UTC	79	IN	Data Raw: 5b 37 31 2c 20 37 33 2c 20 37 30 2c 20 35 36 2c 20 35 37 2c 20 39 37 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 34 34 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 32 5d Data Ascii: [71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.5	50146	34.111.113.62	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:42 UTC	853	OUT	GET /idsync/ex/receive?partner_id=1830&partner_device_id=e09cd2aa-7185-40a5-bf74-4fc29b294347&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:42 UTC	1172	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 17:13:42 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1714151622725;Expires=Tue, 25 Jun 2024 17:13:42 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=c638504f-a3ac-4b31-b48f-7815421f68e5;Expires=Tue, 25 Jun 2024 17:13:42 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1830&partner_device_id=e09cd2aa-7185-40a5-bf74-4fc29b294347&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad Content-Length: 0 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.5	50145	68.67.160.26	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:42 UTC	811	OUT	GET /getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:42 UTC	1570	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3De09cd2aa-7185-40a5-bf74-4fc29b294347 AN-X-Request-Uuid: faeeec89-c6b5-48f7-a81d-930e88069319 Set-Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu, 25-Jul-2024 17:13:42 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Fri, 14-Apr-2034 17:13:42 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=2808008891046894518; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu, 25-Jul-2024 17:13:42 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.5	50147	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:42 UTC	1000	OUT	GET /track/cmf/rubicon?gdpr=0 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsIrKHykciH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSgDMgsIhPP0vt6H8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.
2024-04-26 17:13:42 UTC	632	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:42 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:42 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsIrKHykciH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSABKAMyCwiE8_S-3ofzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..; expires=Sat, 26 Apr 2025 17:13:42 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:42 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.5	50148	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:42 UTC	524	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=13064&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:43 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:43 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760027-MIA
2024-04-26 17:13:43 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.5	50149	68.67.160.26	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	1036	OUT	GET /bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3De09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; receive-cookie-deprecation=1; uuid2=2808008891046894518
2024-04-26 17:13:44 UTC	1491	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=2808008891046894518&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347 AN-X-Request-Uuid: 4899d578-5a9e-42ec-8db8-f89d69809af9 Set-Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu, 25-Jul-2024 17:13:44 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Fri, 14-Apr-2034 17:13:44 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=2808008891046894518; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu, 25-Jul-2024 17:13:44 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.5	50150	34.111.113.62	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	939	OUT	GET /idsync/ex/receive/check?partner_id=1830&partner_device_id=e09cd2aa-7185-40a5-bf74-4fc29b294347&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1714151622725; TapAd_DID=c638504f-a3ac-4b31-b48f-7815421f68e5
2024-04-26 17:13:44 UTC	1380	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 17:13:44 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1714151622725;Expires=Tue, 25 Jun 2024 17:13:44 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=c638504f-a3ac-4b31-b48f-7815421f68e5;Expires=Tue, 25 Jun 2024 17:13:44 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Tue, 25 Jun 2024 17:13:44 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Location: https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Dc638504f-a3ac-4b31-b48f-7815421f68e5%252Chttps%25253A%25252F%25252Fmatch.adsrvr.org%25252Ftrack%25252Fcmf%25252Fgeneric%25253Fttd_pid%25253Dtapad%252C Content-Length: 0 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.5	50151	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	781	OUT	POST /jserrors/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=69954&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1233 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:44 UTC	1233	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 46 72 61 6d 65 77 6f 72 6b 2f 52 65 61 63 74 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 6a 61 78 2f 45 76 65 6e 74 73 2f 45 78 63 6c 75 64 65 64 2f 41 67 65 6e 74 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 34 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 61 64 64 50 61 67 65 41 63 74 69 6f 6e 2f 63 61 6c 6c 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 5d 2c 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 Data Ascii: {"sm":[{"params":{"name":"Framework/React/Detected"},"stats":{"c":1}},{"params":{"name":"Ajax/Events/Excluded/Agent"},"stats":{"c":4}},{"params":{"name":"API/addPageAction/called"},"stats":{"c":1}}],"xhr":[{"params":{"method":"POST","hostname":"bam.nr-dat
2024-04-26 17:13:44 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:44 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760044-MIA
2024-04-26 17:13:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.5	50152	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	778	OUT	POST /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=69957&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 173 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:44 UTC	173	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 2c 36 6a 39 2c 32 36 70 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 69 6e 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 61 70 69 2f 45 6e 31 4d 69 67 55 68 41 32 67 4a 78 53 50 75 78 31 47 43 34 68 44 77 6d 33 53 47 6c 50 4b 52 42 41 6e 44 57 44 4f 31 2f 67 65 74 44 6f 63 75 6d 65 6e 74 2c 2c 32 32 37 2c 31 2c 27 30 2c 27 32 63 32 61 33 36 35 65 36 35 61 63 31 63 32 39 2c 27 32 32 31 37 32 65 64 33 39 64 63 39 33 61 33 33 62 38 36 32 32 65 33 64 35 30 35 36 63 62 65 31 2c 6c 76 67 78 6b 78 79 72 Data Ascii: bel.7;2,,6j9,26p,,,'GET,5k,'in.xero.com:443,'/api/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1/getDocument,,227,1,'0,'2c2a365e65ac1c29,'22172ed39dc93a33b8622e3d5056cbe1,lvgxkxyr
2024-04-26 17:13:44 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:44 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760033-MIA
2024-04-26 17:13:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.5	50158	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	787	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=15363&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 277 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:44 UTC	277	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 73 68 2c 31 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 65 2c 27 66 63 70 2c 73 68 2c 31 3b 35 2c 31 2c 32 3b 65 2c 27 6c 6f 61 64 2c 39 68 64 2c 32 3b 36 2c 27 63 6c 73 2c 30 2e 31 30 31 35 30 36 38 32 38 39 37 38 36 32 32 33 33 3b 35 2c 31 2c 32 3b 65 2c 27 6c 63 70 2c 74 69 2c 38 3b 36 2c 27 73 69 7a 65 2c 34 38 34 38 30 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 65 6c 54 61 67 2c 27 48 31 3b 35 2c 27 6e 65 74 2d 65 74 79 70 65 2c 27 33 67 3b 36 2c 27 6e 65 74 2d 72 74 74 2c 33 30 30 2e 3b 36 2c 27 6e 65 74 2d 64 6c 69 6e 6b 2c 31 2e 33 35 3b 36 2c 35 2c 30 2e 31 30 31 35 30 36 38 32 38 39 37 38 36 32 32 33 33 3b 35 2c 31 2c 32 3b 65 2c 27 70 61 67 65 48 69 64 65 2c 62 75 71 2c 32 3b 36 2c 35 2c 30 2e 31 Data Ascii: bel.6;e,'fp,sh,1;5,'siteVersion,'new;e,'fcp,sh,1;5,1,2;e,'load,9hd,2;6,'cls,0.10150682897862233;5,1,2;e,'lcp,ti,8;6,'size,48480.;5,'eid;5,'elTag,'H1;5,'net-etype,'3g;6,'net-rtt,300.;6,'net-dlink,1.35;6,5,0.10150682897862233;5,1,2;e,'pageHide,buq,2;6,5,0.1
2024-04-26 17:13:44 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:44 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760029-MIA
2024-04-26 17:13:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.5	50160	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	790	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=15366&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1031 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:44 UTC	1031	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 56 65 72 73 69 6f 6e 2f 31 2e 32 33 36 2e 30 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 4c 6f 61 64 65 72 54 79 70 65 2f 73 70 61 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 43 44 4e 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 Data Ascii: {"sm":[{"params":{"name":"Generic/Version/1.236.0/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/LoaderType/spa/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/DistMethod/CDN/Detected"},"stats":{"c":1}},{"params":{"name":"API/setCustomAttri
2024-04-26 17:13:44 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:44 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760045-MIA
2024-04-26 17:13:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.5	50159	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	790	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=15367&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 8141 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:44 UTC	8141	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 33 30 39 39 33 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 31 30 34 7d Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/_next/data/1712725399/us.json","method":"GET","status":200},"metrics":{"count":1,"txSize":{"t":0},"rxSize":{"t":30993},"duration":{"t":104}
2024-04-26 17:13:44 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:44 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760051-MIA
2024-04-26 17:13:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.5	50161	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	788	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=15370&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 2267 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:44 UTC	2267	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 32 71 6b 2c 32 77 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 32 71 75 2c 33 31 2c 2c 2c 30 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2f 73 69 67 6e 75 70 2e 6a 73 6f 6e 2c 2c 62 37 64 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 32 6f 6c 2c 69 62 2c 2c 2c 27 50 4f 53 54 2c 35 6d 2c 31 2c 27 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 2c 64 30 2c 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 32 6f 6a Data Ascii: bel.7;2,1,2qk,2w,,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'0,!!!;5,'siteVersion,'new;2,1,2qu,31,,,0,5k,1,'/_next/data/1712725399/us/signup.json,,b7d,1,3,!!!;5,4,5;2,1,2ol,ib,,,'POST,5m,1,'/api/events/v1/,d0,,1,3,!!!;5,4,5;2,1,2oj
2024-04-26 17:13:44 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:44 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760077-MIA
2024-04-26 17:13:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.5	50157	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	722	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151623380&i=gtm&dwt=3066&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:45 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:44 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,1035adb67365e0c4500b2b62871622c1,10.0.0.207,41498,102.129.152.220,,361521933645,1,1714151624.963,0.001,,.,0,0,0.000,0.004,-,0,0,203,182,91,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.5	50153	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	1075	OUT	GET /track/cmf/appnexus?ttd=1&anid=2808008891046894518&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsIrKHykciH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSABKAMyCwiE8_S-3ofzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..
2024-04-26 17:13:44 UTC	632	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:44 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSACKAMyCwiE8_S-3ofzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..; expires=Sat, 26 Apr 2025 17:13:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:44 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.5	50163	68.67.160.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	1139	OUT	GET /getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Dc638504f-a3ac-4b31-b48f-7815421f68e5%252Chttps%25253A%25252F%25252Fmatch.adsrvr.org%25252Ftrack%25252Fcmf%25252Fgeneric%25253Fttd_pid%25253Dtapad%252C HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; receive-cookie-deprecation=1; uuid2=2808008891046894518
2024-04-26 17:13:45 UTC	1604	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2808008891046894518&pt=c638504f-a3ac-4b31-b48f-7815421f68e5%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%252Fgeneric%253Fttd_pid%253Dtapad%2C AN-X-Request-Uuid: 08295a10-71ce-47c5-af3b-8681de79b3c5 Set-Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu, 25-Jul-2024 17:13:45 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Fri, 14-Apr-2034 17:13:45 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=2808008891046894518; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu, 25-Jul-2024 17:13:45 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.5	50162	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:44 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: 1InqPowcz298cCMbbWEl/A== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:13:45 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:13:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:13:45 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.5	50164	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:45 UTC	536	OUT	GET /jserrors/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=69954&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:45 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:45 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760025-MIA
2024-04-26 17:13:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.5	50165	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:45 UTC	534	OUT	GET /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=69957&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:45 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:45 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760085-MIA
2024-04-26 17:13:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.5	50166	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:45 UTC	490	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151623380&i=gtm&dwt=3066&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:45 UTC	375	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:45 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,3fffe10a06e327f0298e3b2ceccc74cf,10.0.0.58,45592,102.129.152.220,,232876927272,1,1714151625.655,0.002,,.,0,0,0.000,0.000,-,0,0,203,184,92,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.5	50167	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:45 UTC	720	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151624141&i=gtm&dwt=42&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:45 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:45 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,4266405dd68e0ccd094992a3d6bac17c,10.0.0.207,45510,102.129.152.220,,361521938001,1,1714151625.706,0.002,,.,0,0,0.000,0.000,-,0,0,203,150,75,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.5	50168	34.111.113.62	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:45 UTC	988	OUT	GET /idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2808008891046894518&pt=c638504f-a3ac-4b31-b48f-7815421f68e5%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%252Fgeneric%253Fttd_pid%253Dtapad%2C HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1714151622725; TapAd_DID=c638504f-a3ac-4b31-b48f-7815421f68e5; TapAd_3WAY_SYNCS=
2024-04-26 17:13:46 UTC	1146	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 17:13:46 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1714151622725;Expires=Tue, 25 Jun 2024 17:13:46 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=c638504f-a3ac-4b31-b48f-7815421f68e5;Expires=Tue, 25 Jun 2024 17:13:46 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=2!2825;Expires=Tue, 25 Jun 2024 17:13:46 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad Content-Length: 0 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.5	50174	63.140.39.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:46 UTC	734	OUT	POST /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive Content-Length: 360 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" pragma: no-cache sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain accept: / cache-control: no-cache sec-ch-ua-platform: "Windows" Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:46 UTC	360	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 68 61 6e 6e 65 6c 22 3a 22 77 65 62 22 2c 22 61 64 64 72 65 73 73 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 22 2c 22 72 65 66 65 72 72 69 6e 67 55 72 6c 22 3a 22 22 7d 7d 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 78 70 65 72 69 65 6e 63 65 43 6c 6f 75 64 22 3a 7b 22 61 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 22 3a 7b 22 6c 6f 63 Data Ascii: {"context":{"channel":"web","address":{"url":"https://www.xero.com/us/","referringUrl":""}},"id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"experienceCloud":{"audienceManager":{"loc
2024-04-26 17:13:46 UTC	838	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:46 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://www.xero.com access-control-allow-credentials: true x-request-id: a874a70a-8594-4c12-a4c6-8cd102e0e993 timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:13:46 UTC	355	IN	Data Raw: 31 35 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 33 61 66 33 37 62 62 31 2d 64 38 34 32 2d 34 64 34 36 2d 39 62 62 61 2d 34 66 65 31 38 38 31 35 36 32 36 62 22 2c 22 63 6c 69 65 6e 74 22 3a 22 78 65 72 6f 6c 69 6d 69 74 65 64 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 2e 33 34 5f 30 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 34 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 Data Ascii: 15c{"status":200,"requestId":"3af37bb1-d842-4d46-9bba-4fe18815626b","client":"xerolimited","id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651.34_0","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"edgeHost":"mboxedge34.tt.omtrdc.net
2024-04-26 17:13:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.5	50177	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:46 UTC	488	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151624141&i=gtm&dwt=42&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:46 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:46 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,bedab87de5c363bc3408ecf4efa76c0e,10.0.0.58,9116,102.129.152.220,,361521942355,1,1714151626.423,0.002,,.,0,0,0.000,0.004,-,0,0,203,169,84,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.5	50175	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:46 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151624777 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 369 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:46 UTC	369	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 32 34 37 37 37 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 68 61 73 68 3d 26 63 5f 68 6f 73 74 3d 77 77 77 2e 78 65 72 6f 2e 63 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151624777&d_rtbd=json&d_jsonv=1&d_dst=1&c_hash=&c_host=www.xero.co
2024-04-26 17:13:46 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:46 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: E/T1JgEoT0c= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-007c93e32.edge-usw2.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:46 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:46 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:46 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 45 2f 54 31 4a 67 45 6f 54 30 63 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"E/T1JgEoT0c="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.5	50185	63.140.39.82	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:46 UTC	445	OUT	GET /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:47 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Fri, 26 Apr 2024 17:13:47 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:13:47 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-26 17:13:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.5	50188	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:46 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151624777 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:47 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:47 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: 5G7B8XPTTmo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-077d12c14.edge-va6.demdex.com 7 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:47 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:47 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.5	50186	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:47 UTC	1011	OUT	GET /track/cmf/generic?ttd_pid=tapad HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSACKAMyCwiE8_S-3ofzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..
2024-04-26 17:13:47 UTC	632	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:47 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:47 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSADKAMyCwiE8_S-3ofzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..; expires=Sat, 26 Apr 2025 17:13:47 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:47 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.5	50187	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:47 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151624962 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 248 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:47 UTC	248	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 32 34 39 36 32 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 65 66 65 72 72 65 72 3d 6e 6f 74 2d 78 65 72 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151624962&d_rtbd=json&d_jsonv=1&d_dst=1&c_referrer=not-xero
2024-04-26 17:13:47 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:47 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: UMgXRejVQ7Q= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-2-v056-0293ab2f2.edge-usw2.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:47 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:47 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:47 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 55 4d 67 58 52 65 6a 56 51 37 51 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"UMgXRejVQ7Q="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.5	50156	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:47 UTC	1366	OUT	GET /js_tracking?url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&uid=XVsUfradtXcBUl5XS45ldg&v=1&host=https%3A%2F%2Fwww.xero.com HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:47 UTC	242	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:13:47 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.5	50197	172.64.144.225	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:48 UTC	808	OUT	GET /attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/&e=undefined HTTP/1.1 Host: tracking.g2crowd.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _session_id=eef7483c5c58c254b56a96a7aacb6ff9; __cf_bm=sKffacXb53u_QJt4jLSCYZ5Hq8Og8h0bozkWBVGAIL4-1714151591-1.0.1.1-QKEJfB.Abwc.0QYu8PDZbG2WISBQoAgaDNed3TqKHvvrftZet78EKg1uriE6VhQ0zGMrmeWxCCUg8.tXXAlN3Q
2024-04-26 17:13:49 UTC	1313	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:49 GMT Content-Type: text/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=600, public set-cookie: _session_id=eef7483c5c58c254b56a96a7aacb6ff9; path=/; expires=Fri, 10 May 2024 17:13:49 GMT; HttpOnly; secure; SameSite=None etag: W/"3dae93a05edd9dcfc1864b87178a31e0" x-request-id: 829c8dde-f962-4d1a-9f4a-34800d05d9cd x-runtime: 0.008428 strict-transport-security: max-age=604800 x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block x-download-options: noopen x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin content-security-policy: default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a834a2596631fb-MIA
2024-04-26 17:13:49 UTC	22	IN	Data Raw: 31 30 0d 0a 2f 2f 20 54 72 61 63 6b 69 6e 67 20 46 69 6c 65 0d 0a Data Ascii: 10// Tracking File
2024-04-26 17:13:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.5	50199	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:48 UTC	927	OUT	GET /up_loader.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSADKAMyCwiE8_S-3ofzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ.. If-None-Match: "d6f0435164aefe6cf324147b77c7b6bb" If-Modified-Since: Thu, 25 Apr 2024 19:49:47 GMT
2024-04-26 17:13:49 UTC	459	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 25 Apr 2024 19:52:55 GMT Last-Modified: Thu, 25 Apr 2024 19:49:47 GMT ETag: "d6f0435164aefe6cf324147b77c7b6bb" x-amz-server-side-encryption: AES256 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d6605453ddfd18c81ca7f231a465f2ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: e5gMFOMHJB7-inikL2NpSO1XwRk9NdTacl03V_dSSJHSIZkEhvpiDQ== Age: 76855

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.5	50198	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	1220	OUT	GET /events.js HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:49 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:49 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=5
2024-04-26 17:13:49 UTC	8001	IN	Data Raw: 31 66 33 39 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 77 29 20 7b 0a 20 20 2f 2f 20 42 65 67 69 6e 20 64 6f 63 0a 0a 20 20 76 61 72 20 69 73 5f 64 65 76 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 66 61 6c 73 65 20 29 20 7b 0a 20 20 20 20 69 73 5f 64 65 76 20 3d 20 74 72 75 65 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 74 72 75 65 20 29 20 7b 0a 20 20 20 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 74 72 75 65 0a 20 20 7d 0a 0a 20 20 76 61 72 20 74 69 70 20 3d 20 22 6f 4d 6e 75 5a 5a 43 4c 6c 49 65 76 37 4d 4b 44 57 44 5a 52 41 63 59 51 75 2d 56 56 6f 32 55 75 30 66 58 69 6c 52 34 70 32 56 38 22 0a 20 20 0a 20 20 76 61 72 20 75 73 65 72 49 64 43 6f 6f 6b 69 65 Data Ascii: 1f39(function (w) { // Begin doc var is_dev = false; if ( false ) { is_dev = true; } var disable_sync = false; if ( true ) { disable_sync = true } var tip = "oMnuZZCLlIev7MKDWDZRAcYQu-VVo2Uu0fXilR4p2V8" var userIdCookie
2024-04-26 17:13:49 UTC	10005	IN	Data Raw: 32 37 30 64 0d 0a 61 72 20 6f 3d 21 31 2c 74 3d 30 3b 74 3c 73 61 43 6f 6f 6b 69 65 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 74 72 79 7b 72 65 73 2b 3d 22 26 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 73 61 43 6f 6f 6b 69 65 73 5b 74 5d 29 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 43 6f 6f 6b 69 65 73 2e 67 65 74 28 73 61 43 6f 6f 6b 69 65 73 5b 74 5d 29 29 7d 63 61 74 63 68 28 65 29 7b 63 6f 6e 74 69 6e 75 65 7d 6f 3d 21 30 7d 72 65 74 75 72 6e 5b 72 65 73 2c 6f 5d 7d 66 75 6e 63 74 69 6f 6e 20 73 65 74 43 61 6d 70 61 69 67 6e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 28 29 7b 76 61 72 20 65 3d 7b 63 61 6d 70 56 61 6c 75 65 3a 63 61 6d 70 43 6f 6f 6b 69 65 56 61 6c 75 65 2c 74 74 6c 3a 4d 61 74 68 2e 66 6c 6f Data Ascii: 270dar o=!1,t=0;t<saCookies.length;t++){try{res+="&"+encodeURIComponent(saCookies[t])+"="+encodeURIComponent(Cookies.get(saCookies[t]))}catch(e){continue}o=!0}return[res,o]}function setCampaignLocalStorage(){var e={campValue:campCookieValue,ttl:Math.flo
2024-04-26 17:13:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.5	50201	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	850	OUT	POST /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2F&page_title=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive Content-Length: 63 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151618\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:49 UTC	63	OUT	Data Raw: 7b 22 73 72 63 22 3a 22 74 61 67 22 2c 22 61 75 74 68 22 3a 22 42 47 43 53 44 6b 35 4c 45 48 4f 34 4d 50 56 70 67 44 52 4e 75 50 75 65 33 4d 4a 56 35 47 75 64 4d 31 70 30 45 49 42 6b 22 7d Data Ascii: {"src":"tag","auth":"BGCSDk5LEHO4MPVpgDRNuPue3MJV5GudM1p0EIBk"}
2024-04-26 17:13:49 UTC	951	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Content-Length: 3740 Connection: close Date: Fri, 26 Apr 2024 17:13:49 GMT Server: nginx Access-Control-Allow-Origin: https://www.xero.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: x-amz-cf-id Access-Control-Max-Age: 7200 Access-Control-Allow-Credentials: true Api-Version: v2 Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Identification-Source: CACHE Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 25 Apr 2024 17:13:49 GMT Vary: Accept-Encoding, Origin Request-ID: 50389882-1d7d-4735-abb9-598447b048e3 X-Cache: Miss from cloudfront Via: 1.1 c3fb36940fb36cf227975bfb7c09ea6c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: sQZ_mcO58ehsR2HiwJ46e4tObhDnr4_FgB4yrdQxKjb8OfzO-WKlrg==
2024-04-26 17:13:49 UTC	3740	IN	Data Raw: 7b 22 68 71 22 3a 7b 22 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 64 65 6d 61 6e 64 62 61 73 65 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 61 6c 69 61 73 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 69 6e 64 75 73 74 72 79 22 3a 22 42 75 73 69 6e 65 73 73 20 53 65 72 76 69 63 65 73 22 2c 22 73 75 62 5f 69 6e 64 75 73 74 72 79 22 3a 22 47 65 6e 65 72 61 6c 22 2c 22 65 6d 70 6c 6f 79 65 65 5f 63 6f 75 6e 74 22 3a 32 31 38 34 2c 22 70 72 69 6d 61 72 79 5f 73 69 63 22 3a 22 37 33 38 39 22 2c 22 70 72 69 6d 61 72 79 5f 6e 61 69 63 73 22 3a 6e 75 6c 6c 2c 22 73 74 72 65 65 74 5f 61 64 64 72 65 73 73 22 3a 22 35 39 35 20 53 20 38 30 20 45 20 53 74 65 20 33 30 30 22 2c 22 63 69 74 79 Data Ascii: {"hq":{"company_name":"Conservice","demandbase_sid":27340206,"marketing_alias":"Conservice","industry":"Business Services","sub_industry":"General","employee_count":2184,"primary_sic":"7389","primary_naics":null,"street_address":"595 S 80 E Ste 300","city

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.5	50208	34.96.71.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	782	OUT	GET /s/sync?exc=lr HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151618\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:49 UTC	510	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET,OPTIONS Content-Type: text/html; charset=UTF-8 Set-Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1714151629\|ix:0\|mctv:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Fri, 26 Apr 2024 17:13:49 GMT Content-Length: 74 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:49 UTC	74	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Pixels</title></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.5	50203	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	1318	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:49 UTC	1199	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.5	50206	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	1355	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:50 UTC	1236	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.5	50214	13.32.87.20	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	635	OUT	GET /bg9s?x-amz-cf-id=sQZ_mcO58ehsR2HiwJ46e4tObhDnr4_FgB4yrdQxKjb8OfzO-WKlrg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:50 UTC	578	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 6bcc5cb16e0756268a257daab0f6082c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: rpw1MZSLKfhLJbT3rkWkl6rjXZ6TgKV1yGZ5wUEXCdFHZlMHnB5h-w== Age: 71167 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.5	50212	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	3240	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=oMnuZZCLlIev7MKDWDZRAcYQu-VVo2Uu0fXilR4p2V8&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a929394959697989 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:50 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:13:50 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.5	50211	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	3196	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=oMnuZZCLlIev7MKDWDZRAcYQu-VVo2Uu0fXilR4p2V8&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:50 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:13:50 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.5	50222	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	591	OUT	GET /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2F&page_title=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151618\|ix:0\|mctv:0\|rp:0
2024-04-26 17:13:50 UTC	491	IN	HTTP/1.1 401 Unauthorized Content-Type: text/plain;charset=utf-8 Content-Length: 12 Connection: close Date: Fri, 26 Apr 2024 17:13:50 GMT Server: nginx WWW-Authenticate: DemandBase API v2 X-Content-Type-Options: nosniff Request-ID: 306f84e9-0a6b-4c58-be38-2b10fb6ed570 Vary: Origin X-Cache: Error from cloudfront Via: 1.1 f0ccde3c63bb0c13552807c8453d7f50.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: 6qvkj7Ukbb7si7051QjFFlJKAx4aZtZ1HnXw_msMOH-QsA3NFlhwYA==
2024-04-26 17:13:50 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.5	50215	3.215.223.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:49 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151624962 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:13:50 UTC	892	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:50 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: H+ouYJ1DTNg= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-0e1fbafd3.edge-va6.demdex.com 11 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:50 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:13:50 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:13:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.5	50224	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	1352	OUT	GET /activityi;dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:50 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:50 GMT Expires: Fri, 26 Apr 2024 17:13:50 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:13:50 UTC	592	IN	Data Raw: 32 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4d 44 58 38 72 65 77 34 49 55 44 46 57 Data Ascii: 2b3<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CMDX8rew4IUDFW
2024-04-26 17:13:50 UTC	106	IN	Data Raw: 3b 6d 61 74 63 68 5f 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>
2024-04-26 17:13:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.5	50225	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	1389	OUT	GET /activityi;dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:51 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:50 GMT Expires: Fri, 26 Apr 2024 17:13:50 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:13:51 UTC	592	IN	Data Raw: 32 64 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4d 5f 6a 5f 62 65 77 34 49 55 44 46 65 Data Ascii: 2d8<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CM_j_bew4IUDFe
2024-04-26 17:13:51 UTC	143	IN	Data Raw: 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 70 73 63 64 6c 3d 6e 6f 61 70 69 3b 67 74 6d 3d 34 35 66 65 34 34 6f 30 7a 38 38 33 30 39 32 33 34 37 30 7a 61 32 30 31 3b 67 63 64 3d 31 33 6c 33 6c 33 6c 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: =10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>
2024-04-26 17:13:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.5	50229	146.75.124.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	625	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "bbbcf811d8437a575d796a4c1e5d4fad" If-Modified-Since: Thu, 04 Apr 2024 00:26:35 GMT
2024-04-26 17:13:50 UTC	339	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:13:50 GMT Cache-Control: no-cache ETag: "bbbcf811d8437a575d796a4c1e5d4fad" X-Served-By: cache-mia-kmia1760099-MIA X-Cache: HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.5	50227	151.101.65.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	910	OUT	GET /rp.gif?ts=1714151627871&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:50 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:50 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.5	50228	151.101.65.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	910	OUT	GET /rp.gif?ts=1714151627872&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:50 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:50 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.5	50234	13.32.87.128	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	437	OUT	GET /bg9s?x-amz-cf-id=sQZ_mcO58ehsR2HiwJ46e4tObhDnr4_FgB4yrdQxKjb8OfzO-WKlrg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	560	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 3b6959d147738fd4bde35db4104f4052.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: NVElKREfpzhfZO4enF1ske-7yprE0gdud9QtCJQQn1f2ZKYrgDDCgA== Age: 71167 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.5	50238	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	789	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21448&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 261 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:50 UTC	261	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 5f 74 72 61 63 6b 69 6e 67 22 2c 22 73 74 61 74 75 73 22 3a 32 30 34 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 31 37 37 7d 2c 22 63 62 54 69 6d 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 74 69 6d 65 22 3a 7b 22 74 22 3a 31 38 30 38 Data Ascii: {"xhr":[{"params":{"method":"GET","hostname":"tags.srv.stackadapt.com","port":"443","protocol":"https","host":"tags.srv.stackadapt.com:443","pathname":"/js_tracking","status":204},"metrics":{"count":1,"duration":{"t":177},"cbTime":{"t":0},"time":{"t":1808
2024-04-26 17:13:50 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:50 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760024-MIA
2024-04-26 17:13:50 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.5	50239	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	786	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21451&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 99 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:50 UTC	99	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 64 79 68 2c 34 78 2c 2c 2c 27 47 45 54 2c 35 6f 2c 27 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 3a 34 34 33 2c 27 2f 6a 73 5f 74 72 61 63 6b 69 6e 67 2c 2c 2c 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 Data Ascii: bel.7;2,1,dyh,4x,,,'GET,5o,'tags.srv.stackadapt.com:443,'/js_tracking,,,,'0,!!!;5,'siteVersion,'new
2024-04-26 17:13:50 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:50 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760083-MIA
2024-04-26 17:13:50 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.5	50235	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	2998	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=oMnuZZCLlIev7MKDWDZRAcYQu-VVo2Uu0fXilR4p2V8&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:51 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:13:51 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.5	50236	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	3042	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=oMnuZZCLlIev7MKDWDZRAcYQu-VVo2Uu0fXilR4p2V8&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a929394959697989 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:13:51 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:13:51 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.5	50237	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	721	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151629451&i=gtm&dwt=309&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	375	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:51 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,427803d4ba7d15bdd8f1318923a6d1ba,10.0.0.207,2562,102.129.152.220,,232623616232,1,1714151631.015,0.003,,.,0,0,0.000,0.004,-,0,0,203,193,96,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:51 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.5	50232	52.95.115.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:50 UTC	652	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:13:51 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:13:51 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: N6TBH51KMHBTNGXWZHFP Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:13:51 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:13:51 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:13:51 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.5	50240	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: tW+FO0hgG0Bv9onPuOap6g== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:13:51 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:13:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:13:51 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.5	50241	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	1143	OUT	GET /ddm/fls/z/dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.5	50242	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	678	OUT	GET /rp.gif?ts=1714151627871&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:51 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.5	50244	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	678	OUT	GET /rp.gif?ts=1714151627872&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:13:51 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:13:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.5	50243	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	669	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:51 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,2e56d97a69bb056e2562dd1321258be0,10.0.0.207,28830,102.129.152.220,,232876965792,1,1714151631.532,0.004,,.,0,0,0.000,0.004,-,0,0,203,113,56,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:51 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.5	50247	68.67.179.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	916	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151628039&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&st=1714151628039&et=1714151628039&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; receive-cookie-deprecation=1; uuid2=2808008891046894518
2024-04-26 17:13:51 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:51 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:13:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.5	50248	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	1180	OUT	GET /ddm/fls/z/dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.5	50250	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	489	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151629451&i=gtm&dwt=309&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:51 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:51 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,92e1a379ee4e69155543f2ccd2b6997c,10.0.0.58,53336,102.129.152.220,,361521975760,1,1714151631.672,0.004,,.,0,0,0.000,0.004,-,0,0,203,211,105,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:51 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.5	50249	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	673	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=bjCab9J/0tvjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:13:51 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=qiS+yfR8LtHjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:13:51 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:13:51 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:13:51 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.5	50245	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	1319	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:51 UTC	2222	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11527635312992477753","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_ty [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.5	50246	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	1282	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:51 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"16522087127230658522","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.5	50255	18.173.166.39	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	711	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Attribution-Reporting-Eligible: not-navigation-source, trigger=event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:52 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:13:52 GMT x-amzn-RequestId: 0175c3ac-f4ad-4cab-8bbd-8815e31fc86e Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Access-Control-Allow-Credentials: true X-Cache: Miss from cloudfront Via: 1.1 a61500b02203448696480e37b5438a58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: IUoOX3-qOBatfMApI8q7UWdOAcNEcwfkJShSFHnARQqZVOTqwEhlQg==
2024-04-26 17:13:52 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.5	50254	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:51 UTC	852	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629405&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:52 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:52 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.5	50261	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	967	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629405&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: not-navigation-source, trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:53 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:53 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:53 UTC	1579	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:13:53 UTC	73	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`
2024-04-26 17:13:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.5	50252	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	915	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A48%20GMT&n=-2d&b=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:13:53 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:53 GMT Expires: Fri, 26 Apr 2024 17:13:53 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:13:53 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:13:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.5	50260	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	896	OUT	GET /ddm/fls/z/dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:53 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:53 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.5	50256	67.220.224.144	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	481	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:13:53 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:13:53 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: 57ED4QBHVXH4VT9XFGQA Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:13:53 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:13:53 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:13:53 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.5	50251	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	933	OUT	GET /ddm/fls/z/dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:53 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:53 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.5	50257	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	437	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:53 UTC	375	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:13:53 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,e94e2ad68b51cb6a2d3cd401361e8d74,10.0.0.58,23222,102.129.152.220,,232876978993,1,1714151633.614,0.002,,.,0,0,0.000,0.000,-,0,0,203,169,84,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:13:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.5	50258	68.67.160.75	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	532	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151628039&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&st=1714151628039&et=1714151628039&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=2808008891046894518
2024-04-26 17:13:53 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:13:53 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:13:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.5	50259	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	441	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=qiS+yfR8LtHjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:13:53 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=xcnk+eZDxpnjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:13:53 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:13:53 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:13:53 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.5	50263	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	881	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629409&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:54 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=3, ullat=1 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.5	50264	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	996	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629409&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: not-navigation-source, trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:54 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:54 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:54 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:13:54 UTC	73	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`
2024-04-26 17:13:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.5	50265	104.244.42.69	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	965	OUT	GET /i/adsct?bci=3&eci=2&event_id=8dc12951-8188-4ac5-ad59-92c54e4fa24c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dfa53964-83da-4ae7-8635-37f69d087f96&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:13:54 UTC	392	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:53 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 017fd6199c7b0874 strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: 1f01b93bef41775f0eec3797b36aed6ca7864c319ad8853f14e6098f6eb07c62 connection: close
2024-04-26 17:13:54 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.5	50266	104.244.42.195	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	986	OUT	GET /i/adsct?bci=3&eci=2&event_id=8dc12951-8188-4ac5-ad59-92c54e4fa24c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dfa53964-83da-4ae7-8635-37f69d087f96&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:13:54 UTC	400	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:53 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 5b58bc31951f8b16 strict-transport-security: max-age=631138519 x-response-time: 6 x-connection-hash: f03bf350f71ac1f7ac3f113962796bd5388e133907451093ab911f1e874b3eac connection: close
2024-04-26 17:13:54 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.5	50271	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	620	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629405&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:54 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=1, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.5	50272	18.173.166.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	436	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151629413 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:54 UTC	378	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:13:54 GMT x-amzn-RequestId: 9cff6d16-bb22-4e74-aa2e-e31a0a92e2b1 X-Cache: Miss from cloudfront Via: 1.1 2372da0b9ada9b420ec495e2aae6bb8c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: hgzjKr3kDeXHJexJd4l-aoNzSdGtd5e3oM2m4ieKYqStYthJMNnBkw==
2024-04-26 17:13:54 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.5	50267	192.184.68.234	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	1380	OUT	GET /pixel;r=109132992;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151630048;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Beautiful%20Business%20%26%20Accounting%20Software%2Cdescription.Xero%20online%20accounting%20software%20for%20your%20business%20connects%20you%20to%20your%20bank%252C%20acc%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=2a6316c5-21ed-4a1d-8581-02613b31ab4b;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:13:54 UTC	282	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:54 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:13:54 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.5	50262	172.217.3.70	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:53 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:53 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 31 35 32 37 36 33 35 33 31 32 39 39 32 34 37 37 37 35 33 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"11527635312992477753"},"type":"trigger-no-matching-source"}]
2024-04-26 17:13:54 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:13:54 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.5	50269	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	1032	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:54 UTC	2222	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11527635312992477753","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_ty [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.5	50270	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	995	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:13:54 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"16522087127230658522","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:13:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.5	50268	192.178.50.70	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:54 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 36 35 32 32 30 38 37 31 32 37 32 33 30 36 35 38 35 32 32 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"16522087127230658522"},"type":"trigger-no-matching-source"}]
2024-04-26 17:13:54 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:13:54 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.5	50275	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	657	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629405&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:54 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:54 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:54 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.5	50274	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	683	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A13%3A48%20GMT&n=-2d&b=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:13:54 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:54 GMT Expires: Fri, 26 Apr 2024 17:13:54 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:13:54 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.5	50278	142.250.217.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	1687	OUT	GET /pagead/1p-conversion/1023673485/?random=1575969174&cv=11&fst=1714151627962&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=COyov7jaiKzh6QEiEwiV47i4sOCFAxXDiYMIHYG3BeYyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqwBDigQpNJJDZIuyOHNAZ7TBarB7zAlx2UMgPXYfjmTsXiHhU&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaIgI4CnLNoOUdrolbJ7dMwcsSVrYTTzqJg&random=99876488 [TRUNCATED] Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:55 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:55 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:55 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.5	50279	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	649	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629409&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:55 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3404, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:13:55 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.5	50280	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:54 UTC	686	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151629409&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151627886&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:55 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:13:55 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:13:55 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.5	50281	104.244.42.197	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	733	OUT	GET /i/adsct?bci=3&eci=2&event_id=8dc12951-8188-4ac5-ad59-92c54e4fa24c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dfa53964-83da-4ae7-8635-37f69d087f96&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:13:55 UTC	392	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:54 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: ce3ec74f3003677f strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: fd9c8f179b0308ae4f7caa05171d521915f562067809cf3a76141bf2941ec383 connection: close
2024-04-26 17:13:55 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
338	192.168.2.5	50282	104.244.42.67	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	754	OUT	GET /i/adsct?bci=3&eci=2&event_id=8dc12951-8188-4ac5-ad59-92c54e4fa24c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dfa53964-83da-4ae7-8635-37f69d087f96&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:13:55 UTC	400	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:13:55 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 9f31e4bcf55807f6 strict-transport-security: max-age=631138519 x-response-time: 7 x-connection-hash: 12865eaf377865e3273e07be12b1ec57bd15fd51f2ce35d78886314eabf6fde9 connection: close
2024-04-26 17:13:55 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.5	50283	192.184.68.234	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	1148	OUT	GET /pixel;r=109132992;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151630048;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Beautiful%20Business%20%26%20Accounting%20Software%2Cdescription.Xero%20online%20accounting%20software%20for%20your%20business%20connects%20you%20to%20your%20bank%252C%20acc%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=2a6316c5-21ed-4a1d-8581-02613b31ab4b;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:13:55 UTC	354	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:55 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:13:55 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.5	50284	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	778	OUT	POST /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=80826&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 216 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:55 UTC	216	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 6c 63 70 2c 61 6b 69 2c 38 3b 36 2c 27 73 69 7a 65 2c 31 34 36 34 30 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 6e 65 74 2d 65 74 79 70 65 2c 27 33 67 3b 36 2c 27 6e 65 74 2d 72 74 74 2c 33 35 30 2e 3b 36 2c 27 6e 65 74 2d 64 6c 69 6e 6b 2c 31 2e 34 35 3b 35 2c 27 65 6c 55 72 6c 2c 27 68 74 74 70 73 3a 2f 2f 69 6e 2e 78 65 72 6f 2e 63 6f 6d 2f 61 70 69 2f 45 6e 31 4d 69 67 55 68 41 32 67 4a 78 53 50 75 78 31 47 43 34 68 44 77 6d 33 53 47 6c 50 4b 52 42 41 6e 44 57 44 4f 31 2f 67 65 74 4c 6f 67 6f 3b 35 2c 27 65 6c 54 61 67 2c 27 49 4d 47 3b 36 2c 27 63 6c 73 2c 30 2e 30 31 37 37 30 30 30 35 31 39 33 35 32 37 31 32 36 35 Data Ascii: bel.6;e,'lcp,aki,8;6,'size,14640.;5,'eid;5,'net-etype,'3g;6,'net-rtt,350.;6,'net-dlink,1.45;5,'elUrl,'https://in.xero.com/api/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1/getLogo;5,'elTag,'IMG;6,'cls,0.017700051935271265
2024-04-26 17:13:55 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:55 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760070-MIA
2024-04-26 17:13:55 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.5	50286	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	1095	OUT	POST /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=11071&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/&af=err,xhr,stn,ins,spa&be=614&fe=10403&dc=705&perf=%7B%22timing%22:%7B%22of%22:1714151623312,%22n%22:0,%22f%22:3,%22dn%22:38,%22dne%22:38,%22c%22:38,%22s%22:41,%22ce%22:321,%22rq%22:321,%22rp%22:614,%22rpe%22:1164,%22di%22:1276,%22ds%22:1319,%22de%22:1319,%22dc%22:11009,%22l%22:11011,%22le%22:11017%7D,%22navigation%22:%7B%7D%7D&fp=1074&fcp=1074 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 28 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:55 UTC	28	OUT	Data Raw: 7b 22 6a 61 22 3a 7b 22 73 69 74 65 56 65 72 73 69 6f 6e 22 3a 22 6e 65 77 22 7d 7d Data Ascii: {"ja":{"siteVersion":"new"}}
2024-04-26 17:13:55 UTC	436	IN	HTTP/1.1 200 Connection: close Content-Length: 151 date: Fri, 26 Apr 2024 17:13:55 GMT content-type: text/plain cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com access-control-expose-headers: Date timing-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760059-MIA
2024-04-26 17:13:55 UTC	151	IN	Data Raw: 7b 22 73 74 6e 22 3a 30 2c 22 65 72 72 22 3a 31 2c 22 69 6e 73 22 3a 31 2c 22 73 70 61 22 3a 31 2c 22 73 72 22 3a 30 2c 22 73 72 73 22 3a 30 2c 22 73 74 22 3a 30 2c 22 73 74 73 22 3a 30 2c 22 61 70 70 22 3a 7b 22 61 67 65 6e 74 73 22 3a 5b 7b 22 65 6e 74 69 74 79 47 75 69 64 22 3a 22 4d 54 6b 32 4d 6a 41 78 4e 33 78 43 55 6b 39 58 55 30 56 53 66 45 46 51 55 45 78 4a 51 30 46 55 53 55 39 4f 66 44 45 77 4d 6a 4d 7a 4f 44 55 78 4e 6a 41 22 7d 5d 7d 7d Data Ascii: {"stn":0,"err":1,"ins":1,"spa":1,"sr":0,"srs":0,"st":0,"sts":0,"app":{"agents":[{"entityGuid":"MTk2MjAxN3xCUk9XU0VSfEFQUExJQ0FUSU9OfDEwMjMzODUxNjA"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.5	50287	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	1455	OUT	GET /pagead/1p-conversion/1023673485/?random=1575969174&cv=11&fst=1714151627962&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=COyov7jaiKzh6QEiEwiV47i4sOCFAxXDiYMIHYG3BeYyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqwBDigQpNJJDZIuyOHNAZ7TBarB7zAlx2UMgPXYfjmTsXiHhU&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaIgI4CnLNoOUdrolbJ7dMwcsSVrYTTzqJg&random=99876488 [TRUNCATED] Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:56 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:13:56 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:13:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.5	50285	15.197.193.217	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	1087	OUT	GET /track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/ HTTP/1.1 Host: insight.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUYBSADKAMyCwiE8_S-3ofzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..
2024-04-26 17:13:55 UTC	725	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:55 GMT Content-Type: text/html Content-Length: 853 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:13:55 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFGAUoAzILCO7N1sTfh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB; expires=Sat, 26 Apr 2025 17:13:55 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:13:55 UTC	853	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 61 64 73 72 76 72 2e 6f 72 67 2f 75 6e 69 76 65 72 73 61 6c 5f 70 69 78 65 6c 2e 31 2e 31 2e 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 75 6e 69 76 65 72 73 61 6c 50 69 78 65 6c 43 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 6c 6f 62 61 6c 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <html><head> <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script></head><body> <div id="universalPixelContainer"> <script type="text/javascript"> (function(global) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
344	192.168.2.5	50288	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:55 UTC	534	OUT	GET /events/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=80826&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:56 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:56 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760024-MIA
2024-04-26 17:13:56 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.5	50289	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:56 UTC	757	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=11651&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1917 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:56 UTC	1917	OUT	Data Raw: 62 65 6c 2e 37 3b 31 2c 6f 2c 2c 38 7a 6a 2c 38 77 31 2c 61 61 2c 27 69 6e 69 74 69 61 6c 50 61 67 65 4c 6f 61 64 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 2c 31 2c 31 2c 2c 2c 21 21 21 21 27 39 62 32 62 62 35 39 31 2d 65 61 30 61 2d 34 37 39 30 2d 62 32 34 36 2d 34 38 30 37 34 62 32 37 33 66 31 35 2c 27 31 2c 74 75 2c 74 75 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 2c 31 37 76 2c 32 6b 2c 34 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 31 31 2c 21 21 21 3b 32 2c 2c 31 37 7a 2c 32 68 2c 35 2c 2c 36 2c 35 6b 2c 37 2c 27 2f 5f 6e 65 78 74 Data Ascii: bel.7;1,o,,8zj,8w1,aa,'initialPageLoad,'https://www.xero.com/us/,1,1,,,!!!!'9b2bb591-ea0a-4790-b246-48074b273f15,'1,tu,tu;5,'siteVersion,'new;2,,17v,2k,4,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'11,!!!;2,,17z,2h,5,,6,5k,7,'/_next
2024-04-26 17:13:56 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:56 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760047-MIA
2024-04-26 17:13:56 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
346	192.168.2.5	50290	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:56 UTC	850	OUT	GET /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=11071&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/&af=err,xhr,stn,ins,spa&be=614&fe=10403&dc=705&perf=%7B%22timing%22:%7B%22of%22:1714151623312,%22n%22:0,%22f%22:3,%22dn%22:38,%22dne%22:38,%22c%22:38,%22s%22:41,%22ce%22:321,%22rq%22:321,%22rp%22:614,%22rpe%22:1164,%22di%22:1276,%22ds%22:1319,%22de%22:1319,%22dc%22:11009,%22l%22:11011,%22le%22:11017%7D,%22navigation%22:%7B%7D%7D&fp=1074&fcp=1074 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:56 UTC	396	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:13:56 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * x-served-by: cache-mia-kmia1760098-MIA
2024-04-26 17:13:56 UTC	79	IN	Data Raw: 5b 37 31 2c 20 37 33 2c 20 37 30 2c 20 35 36 2c 20 35 37 2c 20 39 37 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 34 34 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 32 5d Data Ascii: [71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.5	50291	104.18.36.155	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:56 UTC	864	OUT	GET /rum?cm_dsp_id=39&external_user_id=e09cd2aa-7185-40a5-bf74-4fc29b294347&expiration=1716743635&gdpr=0&gdpr_consent= HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMID=ZivgqdHM5R4AAA0lAgBSZAAA; CMPS=5589; CMPRO=5589
2024-04-26 17:13:56 UTC	978	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:13:56 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 87a834d02958875d-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZivgqdHM5R4AAA0lAgBSZAAA; Path=/; Domain=casalemedia.com; Expires=Sat, 26 Apr 2025 17:13:56 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=5589; Path=/; Domain=casalemedia.com; Expires=Thu, 25 Jul 2024 17:13:56 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cI6vt2NFs4m0Dovqza22w4Ni9jHi7jiZ8yUE6hdn0ppfONrXtFDZgx5HXOw7FK1ID2Tmr5hpyElZe6pFqIuN3otzQq9QwUmBcuF3d0ugR5FTTAQP9sos2XkLVXuqvmpvPVpMZOBG1l0VLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-04-26 17:13:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.5	50292	108.157.173.58	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:56 UTC	876	OUT	GET /adscores/g.pixel?sid=9211946648&tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347&_redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dadadvisor%26ttd_tpi%3D1%26gdpr%3D1%26gdpr_consent%3D HTTP/1.1 Host: aa.agkn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:56 UTC	905	IN	HTTP/1.1 302 Found Transfer-Encoding: chunked Connection: close Date: Fri, 26 Apr 2024 17:13:56 GMT Server: AAWebServer P3P: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID" Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type Set-Cookie: ab=0001%3A3BfNtFm6%2F%2B%2FKpVZNnI4DfSSY7ANPkOPA; Path=/; Domain=.agkn.com; Expires=Sat, 26-Apr-2025 17:13:56 GMT; Max-Age=31536000; Secure; SameSite=None Location: https://d.agkn.com/pixel/10751/?che=1714151636619&ip=102.129.152.220 X-Cache: Miss from cloudfront Via: 1.1 5f040b97224682b7d52e78e15b9d27ce.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: jK6XBttz9JkZrSjjoUiNgI-aCBxTSb6Nrawk4UuS9OlLmpyPfjnc8Q==
2024-04-26 17:13:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.5	50293	18.66.255.103	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:56 UTC	753	OUT	GET /cgi-bin/m?ci=tradedesk&cg=e09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: secure-gl.imrworldwide.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:13:56 UTC	896	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 44 Connection: close Date: Fri, 26 Apr 2024 17:13:56 GMT Server: nginx Set-Cookie: IMRID=5d72e560-03f0-11ef-8e35-6793f5750268; Path=/;Secure;SameSite=None; Domain=imrworldwide.com; Expires=Wed, 21-May-2025 17:13:56 GMT; Max-Age=33696000 Expires: Thu, 01 Dec 1994 16:00:00 GMT Pragma: no-cache Cache-Control: no-cache P3P: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, OPTIONS cross-origin-resource-policy: cross-origin Accept-CH: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version X-Cache: Miss from cloudfront Via: 1.1 a13130cc0f7aaa5141cc9cd3c3560a5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P1 X-Amz-Cf-Id: QDeYyuJQP9RXRMTTG798UMalr9lVQLzl7XwbAb61ujk3EFt4UmSu4g==
2024-04-26 17:13:56 UTC	44	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 00 Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.5	50294	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:56 UTC	510	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=11651&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:13:57 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:13:56 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760034-MIA
2024-04-26 17:13:57 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
351	192.168.2.5	50295	18.239.225.85	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:13:59 UTC	782	OUT	GET /pixel/10751/?che=1714151636619&ip=102.129.152.220 HTTP/1.1 Host: d.agkn.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ab=0001%3A3BfNtFm6%2F%2B%2FKpVZNnI4DfSSY7ANPkOPA
2024-04-26 17:13:59 UTC	708	IN	HTTP/1.1 200 Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache, must-revalidate Date: Fri, 26 Apr 2024 17:13:58 GMT Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Pragma: no-cache Set-Cookie: ab=0001%3A3BfNtFm6%2F%2B%2FKpVZNnI4DfSSY7ANPkOPA;Path=/;Domain=agkn.com;Max-Age=31536000;SameSite=None;Secure Set-Cookie: u=C\|0AAAAAAAALb6dVwAAAAAA;Path=/;Domain=agkn.com;Max-Age=31536000;SameSite=None;Secure X-Cache: Miss from cloudfront Via: 1.1 15167ef85a9fc2764e4d5ca36adfffde.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: bO9AkrmHi1q6anNFYJUUHJks6PV6GlYiaEs4s7TO-WTTM8mljj8LUw==
2024-04-26 17:13:59 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.5	50297	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:00 UTC	1350	OUT	GET /js_tracking?url=https%3A%2F%2Fwww.xero.com%2Fus%2F&uid=XVsUfradtXcBUl5XS45ldg&v=1&host=https%3A%2F%2Fwww.xero.com HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:00 UTC	242	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:14:00 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.5	50298	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:03 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: d1QlEyqp2sakWC1GhJvSvw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:14:04 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:14:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:14:04 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.5	50301	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:06 UTC	756	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21646&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 149 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:06 UTC	149	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 74 75 2c 31 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 65 2c 27 66 63 70 2c 74 75 2c 31 3b 35 2c 31 2c 32 3b 65 2c 27 70 61 67 65 48 69 64 65 2c 31 66 74 2c 32 3b 36 2c 27 63 6c 73 2c 30 2e 31 30 31 34 33 33 35 36 39 37 33 35 33 39 35 30 32 3b 35 2c 31 2c 32 3b 65 2c 27 6c 6f 61 64 2c 38 69 31 2c 32 3b 36 2c 35 2c 30 2e 31 30 31 34 33 33 35 36 39 37 33 35 33 39 35 30 32 3b 35 2c 31 2c 32 Data Ascii: bel.6;e,'fp,tu,1;5,'siteVersion,'new;e,'fcp,tu,1;5,1,2;e,'pageHide,1ft,2;6,'cls,0.10143356973539502;5,1,2;e,'load,8i1,2;6,5,0.10143356973539502;5,1,2
2024-04-26 17:14:06 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:06 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760057-MIA
2024-04-26 17:14:06 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.5	50302	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:06 UTC	759	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21648&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 6979 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:06 UTC	6979	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 33 30 39 39 33 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 39 32 7d 2c Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/_next/data/1712725399/us.json","method":"GET","status":200},"metrics":{"count":1,"txSize":{"t":0},"rxSize":{"t":30993},"duration":{"t":92},
2024-04-26 17:14:06 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:06 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760051-MIA
2024-04-26 17:14:06 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
356	192.168.2.5	50300	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:06 UTC	757	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21650&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1902 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:06 UTC	1902	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 31 37 76 2c 32 6b 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 31 37 7a 2c 32 68 2c 2c 2c 30 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2f 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 2e 6a 73 6f 6e 2c 2c 76 71 61 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 31 38 30 2c 32 68 2c 2c 2c 30 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2f 73 69 67 6e 75 70 2e 6a 73 6f 6e 2c Data Ascii: bel.7;2,1,17v,2k,,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'0,!!!;5,'siteVersion,'new;2,1,17z,2h,,,0,5k,1,'/_next/data/1712725399/us/pricing-plans.json,,vqa,1,3,!!!;5,4,5;2,1,180,2h,,,0,5k,1,'/_next/data/1712725399/us/signup.json,
2024-04-26 17:14:06 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:06 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760036-MIA
2024-04-26 17:14:06 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.5	50303	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:06 UTC	510	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21646&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:07 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:06 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760069-MIA
2024-04-26 17:14:07 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.5	50304	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:06 UTC	512	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21648&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:07 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:06 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760069-MIA
2024-04-26 17:14:07 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.5	50305	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:06 UTC	510	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=21650&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:07 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:06 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760050-MIA
2024-04-26 17:14:07 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.5	50306	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:10 UTC	397	OUT	OPTIONS /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Origin: https://alb.reddit.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:11 UTC	644	IN	HTTP/1.1 204 No Content Connection: close Server: Varnish Retry-After: 0 Access-Control-Allow-Origin: https://alb.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:11 GMT Via: 1.1 varnish Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.5	50307	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:11 UTC	397	OUT	OPTIONS /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Origin: https://alb.reddit.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:11 UTC	644	IN	HTTP/1.1 204 No Content Connection: close Server: Varnish Retry-After: 0 Access-Control-Allow-Origin: https://alb.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:11 GMT Via: 1.1 varnish Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.5	50308	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:11 UTC	403	OUT	OPTIONS /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Origin: https://www.redditstatic.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:11 UTC	650	IN	HTTP/1.1 204 No Content Connection: close Server: Varnish Retry-After: 0 Access-Control-Allow-Origin: https://www.redditstatic.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:11 GMT Via: 1.1 varnish Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.5	50309	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:11 UTC	340	OUT	POST /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Content-Length: 720 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:11 UTC	720	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 39 31 35 36 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 35 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 33 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 35 31 2e 31 30 31 2e 31 2e 31 34 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6c 62 2e 72 65 64 64 69 74 2e 63 6f 6d 2f 72 70 2e 67 69 Data Ascii: [{"age":19156,"body":{"elapsed_time":552,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":0.3,"server_ip":"151.101.1.140","status_code":200,"type":"ok"},"type":"network-error","url":"https://alb.reddit.com/rp.gi
2024-04-26 17:14:11 UTC	681	IN	HTTP/1.1 200 OK Connection: close Content-Length: 0 content-type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:11 GMT Via: 1.1 varnish Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block server: snooserv Access-Control-Allow-Origin: https://www.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.5	50310	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:11 UTC	340	OUT	POST /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Content-Length: 742 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:11 UTC	742	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 39 37 32 34 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 36 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 33 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 35 31 2e 31 30 31 2e 36 35 2e 31 34 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a Data Ascii: [{"age":19724,"body":{"elapsed_time":563,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://www.xero.com/","sampling_fraction":0.3,"server_ip":"151.101.65.140","status_code":200,"type":"ok"},"type":"network-error","url":"https:
2024-04-26 17:14:11 UTC	681	IN	HTTP/1.1 200 OK Connection: close Content-Length: 0 content-type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:11 GMT Via: 1.1 varnish Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block server: snooserv Access-Control-Allow-Origin: https://www.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.5	50311	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:11 UTC	340	OUT	POST /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Content-Length: 447 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:11 UTC	447	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 33 32 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 38 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 32 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 35 31 2e 31 30 31 2e 31 2e 31 34 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 64 64 69 74 73 74 61 74 69 63 2e 63 6f Data Ascii: [{"age":59322,"body":{"elapsed_time":685,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":0.02,"server_ip":"151.101.1.140","status_code":200,"type":"ok"},"type":"network-error","url":"https://www.redditstatic.co
2024-04-26 17:14:11 UTC	681	IN	HTTP/1.1 200 OK Connection: close Content-Length: 0 content-type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:11 GMT Via: 1.1 varnish Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block server: snooserv Access-Control-Allow-Origin: https://www.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.5	50313	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:13 UTC	773	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=28802&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 301 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:13 UTC	301	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 6c 63 70 2c 31 37 70 2c 39 3b 36 2c 27 73 69 7a 65 2c 34 30 32 32 38 37 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 65 6c 55 72 6c 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 64 61 6d 2f 78 65 72 6f 2f 70 69 6c 6f 74 2d 69 6d 61 67 65 73 2f 65 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 2f 32 30 32 34 2d 71 34 2d 61 77 61 72 64 73 2d 62 61 64 67 65 73 2d 66 6f 72 2d 68 65 61 64 65 72 73 2f 55 53 5f 25 32 30 54 72 75 73 74 70 69 6c 6f 74 5f 47 32 2e 31 37 31 30 33 38 33 30 35 35 30 33 38 2e 70 6e 67 3b 35 2c 27 65 6c 54 61 67 2c 27 49 4d 47 3b 35 2c 27 6e 65 74 2d 65 74 79 70 65 2c 27 33 67 3b 36 2c 27 6e 65 74 2d 72 74 74 2c 33 35 30 2e 3b 36 2c 27 6e 65 74 2d 64 6c 69 6e 6b 2c 31 2e 35 3b Data Ascii: bel.6;e,'lcp,17p,9;6,'size,402287.;5,'eid;5,'elUrl,'https://www.xero.com/content/dam/xero/pilot-images/experimentation/2024-q4-awards-badges-for-headers/US_%20Trustpilot_G2.1710383055038.png;5,'elTag,'IMG;5,'net-etype,'3g;6,'net-rtt,350.;6,'net-dlink,1.5;
2024-04-26 17:14:13 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:13 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760056-MIA
2024-04-26 17:14:13 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.5	50314	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:13 UTC	776	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=28876&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1197 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:13 UTC	1197	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 56 65 72 73 69 6f 6e 2f 31 2e 32 33 36 2e 30 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 4c 6f 61 64 65 72 54 79 70 65 2f 73 70 61 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 43 44 4e 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 Data Ascii: {"sm":[{"params":{"name":"Generic/Version/1.236.0/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/LoaderType/spa/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/DistMethod/CDN/Detected"},"stats":{"c":1}},{"params":{"name":"API/setCustomAttri
2024-04-26 17:14:13 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:13 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760031-MIA
2024-04-26 17:14:13 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.5	50315	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:13 UTC	775	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=28879&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 769 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:13 UTC	769	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 65 76 65 6e 74 73 2f 31 2f 65 31 36 38 61 66 63 37 62 31 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 32 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 30 35 31 2c 22 6d 69 6e 22 3a 31 34 39 2c 22 6d 61 78 22 3a 31 39 30 32 2c 22 73 6f 73 22 3a 33 36 33 39 38 30 35 2c 22 63 22 3a 32 7d 2c Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/events/1/e168afc7b1","status":200},"metrics":{"count":2,"txSize":{"t":2051,"min":149,"max":1902,"sos":3639805,"c":2},
2024-04-26 17:14:13 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:13 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760024-MIA
2024-04-26 17:14:13 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.5	50312	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:13 UTC	707	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151652104&i=gtm&dwt=17775&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:13 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:13 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,4486134f319e13e4fac2d094e13cc366,10.0.0.207,47906,102.129.152.220,,361522093675,1,1714151653.643,0.005,,.,0,0,0.000,0.004,-,0,0,203,129,64,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:13 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.5	50320	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:17 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151652767 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 725 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:17 UTC	725	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 35 32 37 36 37 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 75 74 6d 5f 73 6f 75 72 63 65 3d 78 65 72 6f 2d 69 6e 76 6f 69 63 65 26 Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151652767&d_rtbd=json&d_jsonv=1&d_dst=1&c_utm_source=xero-invoice&
2024-04-26 17:14:17 UTC	989	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:17 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: n1KxgutoQms= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-08902eadf.edge-usw2.demdex.com 264 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:17 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:17 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:17 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 6e 31 4b 78 67 75 74 6f 51 6d 73 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"n1KxgutoQms="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.5	50319	52.3.212.252	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:17 UTC	475	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151652104&i=gtm&dwt=17775&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:17 UTC	375	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:17 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,69968e5ed664aaa85dce4d70f9286940,10.0.0.58,22612,102.129.152.220,,232877108008,1,1714151657.534,0.002,,.,0,0,0.000,0.000,-,0,0,203,176,88,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:17 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.5	50318	63.140.39.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:17 UTC	734	OUT	POST /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive Content-Length: 474 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" pragma: no-cache sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain accept: / cache-control: no-cache sec-ch-ua-platform: "Windows" Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:17 UTC	474	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 68 61 6e 6e 65 6c 22 3a 22 77 65 62 22 2c 22 61 64 64 72 65 73 73 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 74 72 79 2d 6e 6f 77 2f 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 78 65 72 6f 2d 69 6e 76 6f 69 63 65 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 72 65 66 65 72 72 61 6c 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 67 6c 6f 62 61 6c 2d 64 2d 6c 66 2d 78 65 72 6f 69 6e 76 6f 69 63 65 72 65 66 65 72 72 61 6c 73 22 2c 22 72 65 66 65 72 72 69 6e 67 55 72 6c 22 3a 22 22 7d 7d 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 Data Ascii: {"context":{"channel":"web","address":{"url":"https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals","referringUrl":""}},"id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f146
2024-04-26 17:14:17 UTC	838	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:17 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://www.xero.com access-control-allow-credentials: true x-request-id: d8db9351-4df9-4b96-8d5b-218295f3f912 timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:17 UTC	355	IN	Data Raw: 31 35 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 30 33 63 36 31 33 31 31 2d 62 66 65 34 2d 34 34 32 65 2d 38 61 64 36 2d 34 66 34 34 62 33 31 35 32 31 33 61 22 2c 22 63 6c 69 65 6e 74 22 3a 22 78 65 72 6f 6c 69 6d 69 74 65 64 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 2e 33 34 5f 30 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 34 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 Data Ascii: 15c{"status":200,"requestId":"03c61311-bfe4-442e-8ad6-4f44b315213a","client":"xerolimited","id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651.34_0","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"edgeHost":"mboxedge34.tt.omtrdc.net
2024-04-26 17:14:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.5	50322	13.249.98.6	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:18 UTC	1302	OUT	GET /stats/TrustboxImpression?locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=4becd84a00006400050b6782&widgetId=53aa8912dec7e10d38f59f36 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:18 UTC	459	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Fri, 26 Apr 2024 17:14:18 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5191af3e8a3a86edd9b91d6d2c886236.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: TV6nMbqRllywVGWA8Kfx0hZfGreFEeFzw5ss1nSGJg56W6o1qCtEng==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.5	50325	63.140.39.82	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:18 UTC	445	OUT	GET /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:18 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Fri, 26 Apr 2024 17:14:18 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:18 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-26 17:14:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.5	50323	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:18 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151656491 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 248 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:18 UTC	248	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 35 36 34 39 31 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 65 66 65 72 72 65 72 3d 6e 6f 74 2d 78 65 72 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151656491&d_rtbd=json&d_jsonv=1&d_dst=1&c_referrer=not-xero
2024-04-26 17:14:18 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:18 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: wi6bw8d6S7s= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-2-v056-0a835ead6.edge-usw2.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:18 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:18 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:18 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 77 69 36 62 77 38 64 36 53 37 73 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"wi6bw8d6S7s="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.5	50327	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:18 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151652767 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:18 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:18 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: D/5taUrGQDQ= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-01a48d59e.edge-va6.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:18 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:18 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:18 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.5	50331	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151656491 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:19 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:19 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: HQPmx67gRmM= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-07261d572.edge-va6.demdex.com 7 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:19 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:19 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:19 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.5	50332	172.217.204.155	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	954	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1632723499&gjid=1566794308&_gid=1323772131.1714151589&_u=QACAAEAAAAAAACgEK~&z=360280914 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.xero.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:19 UTC	590	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.xero.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Fri, 26 Apr 2024 17:14:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:19 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.5	50334	151.101.65.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	629	OUT	GET /ads/pixel.js HTTP/1.1 Host: www.redditstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "c4d61fbb6e730a840c7f140cbb9bcd06" If-Modified-Since: Wed, 24 Apr 2024 17:35:49 GMT
2024-04-26 17:14:19 UTC	821	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:14:19 GMT Via: 1.1 varnish Cache-Control: public, max-age=60 ETag: "c4d61fbb6e730a840c7f140cbb9bcd06" Vary: Accept-Encoding,Origin Server: snooserv Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.5	50335	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	1220	OUT	GET /events.js HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:19 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:19 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=5
2024-04-26 17:14:19 UTC	16192	IN	Data Raw: 34 36 34 36 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 77 29 20 7b 0a 20 20 2f 2f 20 42 65 67 69 6e 20 64 6f 63 0a 0a 20 20 76 61 72 20 69 73 5f 64 65 76 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 66 61 6c 73 65 20 29 20 7b 0a 20 20 20 20 69 73 5f 64 65 76 20 3d 20 74 72 75 65 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 74 72 75 65 20 29 20 7b 0a 20 20 20 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 74 72 75 65 0a 20 20 7d 0a 0a 20 20 76 61 72 20 74 69 70 20 3d 20 22 31 72 4f 6a 4e 50 50 38 61 64 53 54 75 4e 77 76 4f 4d 43 54 6d 32 4c 66 38 50 54 79 30 51 33 65 41 73 53 7a 35 69 76 59 71 57 77 22 0a 20 20 0a 20 20 76 61 72 20 75 73 65 72 49 64 43 6f 6f 6b 69 65 Data Ascii: 4646(function (w) { // Begin doc var is_dev = false; if ( false ) { is_dev = true; } var disable_sync = false; if ( true ) { disable_sync = true } var tip = "1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw" var userIdCookie
2024-04-26 17:14:19 UTC	1806	IN	Data Raw: 69 66 28 22 22 21 3d 63 61 6d 70 43 6f 6f 6b 69 65 4e 61 6d 65 29 74 72 79 7b 43 6f 6f 6b 69 65 73 2e 65 78 70 69 72 65 43 61 6d 70 61 69 67 6e 43 6f 6f 6b 69 65 73 28 34 29 2c 73 65 74 43 61 6d 70 61 69 67 6e 43 6f 6f 6b 69 65 28 29 2c 65 78 70 69 72 65 43 61 6d 70 61 69 67 6e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 28 29 2c 73 65 74 43 61 6d 70 61 69 67 6e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 69 66 28 22 22 21 3d 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 61 6c 75 65 26 26 43 6f 6f 6b 69 65 73 2e 67 65 74 28 22 73 61 2d 75 73 65 72 2d 69 64 22 29 21 3d 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 61 6c 75 65 29 74 72 79 7b 73 65 74 55 73 65 72 49 64 43 6f 6f 6b 69 65 28 29 2c 73 65 74 55 73 65 72 49 64 43 6f 6f 6b 69 65 56 32 28 Data Ascii: if(""!=campCookieName)try{Cookies.expireCampaignCookies(4),setCampaignCookie(),expireCampaignLocalStorage(),setCampaignLocalStorage()}catch(e){}if(""!=userIdCookieValue&&Cookies.get("sa-user-id")!=userIdCookieValue)try{setUserIdCookie(),setUserIdCookieV2(
2024-04-26 17:14:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.5	50338	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	1523	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:19 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:19 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.5	50342	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	1019	OUT	GET /up_loader.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFGAUoAzILCO7N1sTfh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB If-None-Match: "d6f0435164aefe6cf324147b77c7b6bb" If-Modified-Since: Thu, 25 Apr 2024 19:49:47 GMT
2024-04-26 17:14:19 UTC	459	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 25 Apr 2024 19:52:55 GMT Last-Modified: Thu, 25 Apr 2024 19:49:47 GMT ETag: "d6f0435164aefe6cf324147b77c7b6bb" x-amz-server-side-encryption: AES256 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 af68fd87ee6cdda16f897e9bf046dd8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: dYKyzmPHH35VS2XCNGrcc3847IbIhYhJPWn6DHwOxGsa5-qG5v0Grw== Age: 76885

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.5	50336	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	1611	OUT	GET /td/rul/1023673485?random=1714151657883&cv=11&fst=1714151657883&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:19 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:19 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.5	50337	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	1487	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:19 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:19 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.5	50344	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	974	OUT	POST /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&page_title=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive Content-Length: 63 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151629\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:19 UTC	63	OUT	Data Raw: 7b 22 73 72 63 22 3a 22 74 61 67 22 2c 22 61 75 74 68 22 3a 22 42 47 43 53 44 6b 35 4c 45 48 4f 34 4d 50 56 70 67 44 52 4e 75 50 75 65 33 4d 4a 56 35 47 75 64 4d 31 70 30 45 49 42 6b 22 7d Data Ascii: {"src":"tag","auth":"BGCSDk5LEHO4MPVpgDRNuPue3MJV5GudM1p0EIBk"}
2024-04-26 17:14:19 UTC	951	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Content-Length: 3740 Connection: close Date: Fri, 26 Apr 2024 17:14:19 GMT Server: nginx Access-Control-Allow-Origin: https://www.xero.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: x-amz-cf-id Access-Control-Max-Age: 7200 Access-Control-Allow-Credentials: true Api-Version: v2 Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Identification-Source: CACHE Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 25 Apr 2024 17:14:19 GMT Vary: Accept-Encoding, Origin Request-ID: 0b56f7e2-5171-4a4d-8103-c0dce66964a6 X-Cache: Miss from cloudfront Via: 1.1 9c1e51085ad77fbbab78fe2feb46cf98.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: kcHZWXPZYGy4JHiZ4tqDMc-ko-1jcfFf5rV_sByU_Reqcrnv4g70gw==
2024-04-26 17:14:19 UTC	3740	IN	Data Raw: 7b 22 68 71 22 3a 7b 22 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 64 65 6d 61 6e 64 62 61 73 65 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 61 6c 69 61 73 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 69 6e 64 75 73 74 72 79 22 3a 22 42 75 73 69 6e 65 73 73 20 53 65 72 76 69 63 65 73 22 2c 22 73 75 62 5f 69 6e 64 75 73 74 72 79 22 3a 22 47 65 6e 65 72 61 6c 22 2c 22 65 6d 70 6c 6f 79 65 65 5f 63 6f 75 6e 74 22 3a 32 31 38 34 2c 22 70 72 69 6d 61 72 79 5f 73 69 63 22 3a 22 37 33 38 39 22 2c 22 70 72 69 6d 61 72 79 5f 6e 61 69 63 73 22 3a 6e 75 6c 6c 2c 22 73 74 72 65 65 74 5f 61 64 64 72 65 73 73 22 3a 22 35 39 35 20 53 20 38 30 20 45 20 53 74 65 20 33 30 30 22 2c 22 63 69 74 79 Data Ascii: {"hq":{"company_name":"Conservice","demandbase_sid":27340206,"marketing_alias":"Conservice","industry":"Business Services","sub_industry":"General","employee_count":2184,"primary_sic":"7389","primary_naics":null,"street_address":"595 S 80 E Ste 300","city

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.5	50341	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	1512	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:19 UTC	1393	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.5	50340	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	1476	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:19 UTC	1357	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.5	50345	34.96.71.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:19 UTC	782	OUT	GET /s/sync?exc=lr HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151629\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:19 UTC	510	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET,OPTIONS Content-Type: text/html; charset=UTF-8 Set-Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1714151659\|ix:0\|mctv:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Fri, 26 Apr 2024 17:14:19 GMT Content-Length: 74 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:19 UTC	74	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Pixels</title></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.5	50349	173.194.213.154	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:21 UTC	710	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1632723499&gjid=1566794308&_gid=1323772131.1714151589&_u=QACAAEAAAAAAACgEK~&z=360280914 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:21 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Fri, 26 Apr 2024 17:14:21 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:21 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.5	50350	13.32.87.128	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:21 UTC	635	OUT	GET /bg9s?x-amz-cf-id=kcHZWXPZYGy4JHiZ4tqDMc-ko-1jcfFf5rV_sByU_Reqcrnv4g70gw==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:22 UTC	578	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 b6efbf009f233af7a7aa7da68e6e2848.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: 9SbYMgB3v1DMOAqRqqjBz7Vw0eZzwmXQq0FTwe7grz3yqPRYyKi8Tw== Age: 71198 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.5	50351	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:21 UTC	1510	OUT	GET /activityi;dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:22 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:22 GMT Expires: Fri, 26 Apr 2024 17:14:22 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:22 UTC	592	IN	Data Raw: 33 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4e 62 34 6c 4d 61 77 34 49 55 44 46 65 Data Ascii: 351<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CNb4lMaw4IUDFe
2024-04-26 17:14:22 UTC	264	IN	Data Raw: 67 63 64 3d 31 33 6c 33 6c 33 6c 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 6d 61 74 63 68 5f 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 74 72 79 2d 6e 6f 77 25 32 46 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 25 32 46 25 33 46 75 74 6d 5f 73 6f 75 72 63 65 25 33 44 78 65 72 6f 2d 69 6e 76 6f 69 63 65 25 32 36 75 74 6d 5f 6d 65 64 69 75 6d 25 33 44 72 65 66 65 72 72 61 6c 25 32 36 75 74 6d 5f 63 61 6d 70 61 69 67 6e 25 33 44 67 6c 6f 62 61 6c 2d 64 2d 6c 66 2d 78 65 72 6f 69 6e 76 6f 69 63 65 72 65 66 65 72 72 61 6c 73 22 2f 3e 3c 2f 62 6f 64 79 3e Data Ascii: gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals"/></body>
2024-04-26 17:14:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.5	50352	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:21 UTC	1546	OUT	GET /activityi;dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:22 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:22 GMT Expires: Fri, 26 Apr 2024 17:14:22 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:22 UTC	592	IN	Data Raw: 33 37 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4f 66 76 6c 4d 61 77 34 49 55 44 46 65 Data Ascii: 375<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COfvlMaw4IUDFe
2024-04-26 17:14:22 UTC	300	IN	Data Raw: 61 6d 62 3d 30 3b 75 61 6d 3d 3b 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 70 73 63 64 6c 3d 6e 6f 61 70 69 3b 67 74 6d 3d 34 35 66 65 34 34 6f 30 7a 38 38 33 30 39 32 33 34 37 30 7a 61 32 30 31 3b 67 63 64 3d 31 33 6c 33 6c 33 6c 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 74 72 79 2d 6e 6f 77 25 32 46 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 25 32 46 25 33 46 75 74 6d 5f 73 6f 75 72 63 65 25 33 44 78 65 72 6f 2d 69 6e 76 6f 69 63 65 25 32 36 75 74 6d 5f 6d 65 64 69 75 6d 25 33 44 72 65 66 65 72 72 61 6c 25 32 36 75 74 6d 5f 63 61 6d 70 61 69 67 6e 25 33 44 67 6c 6f 62 61 6c Data Ascii: amb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal
2024-04-26 17:14:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.5	50353	146.75.124.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:21 UTC	625	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "bbbcf811d8437a575d796a4c1e5d4fad" If-Modified-Since: Thu, 04 Apr 2024 00:26:35 GMT
2024-04-26 17:14:22 UTC	339	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:14:21 GMT Cache-Control: no-cache ETag: "bbbcf811d8437a575d796a4c1e5d4fad" X-Served-By: cache-mia-kmia1760080-MIA X-Cache: HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.5	50355	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:21 UTC	3364	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a1617181 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:22 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:22 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.5	50354	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:21 UTC	3320	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:22 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:22 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.5	50358	13.35.116.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	715	OUT	GET /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&page_title=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151659\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:22 UTC	491	IN	HTTP/1.1 401 Unauthorized Content-Type: text/plain;charset=utf-8 Content-Length: 12 Connection: close Date: Fri, 26 Apr 2024 17:14:22 GMT Server: nginx WWW-Authenticate: DemandBase API v2 X-Content-Type-Options: nosniff Request-ID: 28338e0d-9c4f-48d1-9756-7fd784b8a171 Vary: Origin X-Cache: Error from cloudfront Via: 1.1 aee6619aa3e21e3827aea4ae78caedb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: ek--nfTauwa8laWq3qcX4Qg_0lNDMq91l180jux20LAWZSL4XgbTLQ==
2024-04-26 17:14:22 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.5	50360	13.32.87.74	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	437	OUT	GET /bg9s?x-amz-cf-id=kcHZWXPZYGy4JHiZ4tqDMc-ko-1jcfFf5rV_sByU_Reqcrnv4g70gw==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:22 UTC	560	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 b3ca1a7752327aa687a6611c7f28951e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: _OQygrY7vtQ3br8QL9ySYGmP8WEClnMwaVYpKgjSrR3tkF18HGcy9Q== Age: 71199 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.5	50362	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	1301	OUT	GET /ddm/fls/z/dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:22 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:22 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:22 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.5	50364	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	1494	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger;navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:23 UTC	2222	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:22 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"13519180499126775960","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_ty [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:22 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.5	50366	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	799	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:22 UTC	373	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:22 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,a71a42237b32b655634b3dc9dff5ba53,10.0.0.207,2260,102.129.152.220,,8589374450,1,1714151662.923,0.002,,.,0,0,0.000,0.000,-,0,0,203,175,87,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:22 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.5	50369	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	3166	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a1617181 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:22 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:14:22 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.5	50368	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	3122	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&t=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&tip=1rOjNPP8adSTuNwvOMCTm2Lf8PTy0Q3eAsSz5ivYqWw&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:22 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:14:22 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.5	50365	67.220.226.233	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	652	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151661107 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:14:23 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:14:23 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: MMNJTQGQH48R04PSNRKT Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:14:23 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:14:23 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:14:23 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.5	50367	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:22 UTC	1046	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151658018&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&st=1714151658018&et=1714151658019&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; receive-cookie-deprecation=1; uuid2=2808008891046894518
2024-04-26 17:14:22 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:14:22 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:14:22 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.5	50371	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	1054	OUT	GET /ddm/fls/z/dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:23 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:23 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.5	50370	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	1039	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A18%20GMT&n=-2d&b=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:14:23 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:23 GMT Expires: Fri, 26 Apr 2024 17:14:23 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:14:23 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:14:23 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.5	50373	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	910	OUT	GET /rp.gif?ts=1714151658537&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:23 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:23 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.5	50374	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	910	OUT	GET /rp.gif?ts=1714151658542&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:23 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:23 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.5	50376	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	567	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:23 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:23 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,111c595deaa9f1e3dfa9176fea13f72a,10.0.0.207,20962,102.129.152.220,,232877139154,1,1714151663.714,0.002,,.,0,0,0.000,0.000,-,0,0,203,135,67,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:23 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.5	50372	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	673	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=xcnk+eZDxpnjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:14:23 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=BULsTdJEJ0rjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:14:23 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:14:23 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:14:23 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
411	192.168.2.5	50375	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	662	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151658018&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&st=1714151658018&et=1714151658019&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=2808008891046894518
2024-04-26 17:14:23 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:14:23 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:14:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
412	192.168.2.5	50378	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	1189	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:23 UTC	2222	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:23 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"13519180499126775960","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_ty [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:23 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.5	50377	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:23 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 33 35 31 39 31 38 30 34 39 39 31 32 36 37 37 35 39 36 30 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"13519180499126775960"},"type":"trigger-no-matching-source"}]
2024-04-26 17:14:24 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:14:24 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.5	50363	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	1440	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:23 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:23 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"16447495397759381636","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:23 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.5	50381	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	982	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660500&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3403, tp=-1, tpl=-1, uplat=3, ullat=1 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:23 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.5	50383	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	688	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151661107 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Attribution-Reporting-Eligible: trigger=event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:14:23 GMT x-amzn-RequestId: 1196357b-76a2-4b2e-ad2a-59dd6f62d3d3 Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Access-Control-Allow-Credentials: true X-Cache: Miss from cloudfront Via: 1.1 90f213fc1bf2dcf0cc7a135191b4c336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: Enha3h82Y7SEB11MrTZwNf8wuCSGfXAVFYzn0Ldb3kkee7KZkYp_rA==
2024-04-26 17:14:24 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.5	50379	142.250.217.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:23 UTC	813	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1632723499&_u=QACAAEAAAAAAACgEK~&z=984487653 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:24 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.5	50382	52.94.222.140	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	481	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151661107 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:14:24 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:14:24 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: XRYF0MY2ZP3W6FTTC556 Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:14:24 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:14:24 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:14:24 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.5	50387	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1074	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660500&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:24 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:24 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:14:24 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.5	50385	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	678	OUT	GET /rp.gif?ts=1714151658537&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:24 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
421	192.168.2.5	50386	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	678	OUT	GET /rp.gif?ts=1714151658542&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:24 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
422	192.168.2.5	50388	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	441	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=BULsTdJEJ0rjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:14:24 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=Cq0qGiA5A3jjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:14:24 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:14:24 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:14:24 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.5	50361	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1337	OUT	GET /ddm/fls/z/dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:24 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.5	50389	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1090	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660504&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3402, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:24 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
425	192.168.2.5	50384	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	807	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A18%20GMT&n=-2d&b=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:14:24 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:24 GMT Expires: Fri, 26 Apr 2024 17:14:24 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:14:24 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.5	50391	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1182	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660504&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:24 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:24 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:14:24 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.5	50390	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1153	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:24 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:24 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"16447495397759381636","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:24 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.5	50392	104.244.42.195	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1116	OUT	GET /i/adsct?bci=3&eci=2&event_id=70aabc88-9ea8-46ff-84d1-5f38d7ff16af&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=568b43ac-705c-43aa-b1ba-ae28fea95969&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:14:24 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:24 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 759cafb717fbad6b strict-transport-security: max-age=631138519 x-response-time: 89 x-connection-hash: 4323f12c6d8a6c06a2c956c9b111a8c61f402b8f999ecd41509afd7432472936 connection: close
2024-04-26 17:14:24 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.5	50394	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	750	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660500&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:24 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
430	192.168.2.5	50397	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	436	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151661107 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	378	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:14:24 GMT x-amzn-RequestId: a5e80840-2d5d-4e91-806e-ecd46a98f38b X-Cache: Miss from cloudfront Via: 1.1 abdbda373f0ee600e1b9e86e5aa747a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: V56e4tC_2gCxzfUgm5xQn0k4smK0zf7IE9WpiU-23HjOp-32e9-9xQ==
2024-04-26 17:14:24 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
431	192.168.2.5	50393	172.217.165.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 36 34 34 37 34 39 35 33 39 37 37 35 39 33 38 31 36 33 36 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"16447495397759381636"},"type":"trigger-no-matching-source"}]
2024-04-26 17:14:24 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:14:24 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.5	50395	104.244.42.133	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1095	OUT	GET /i/adsct?bci=3&eci=2&event_id=70aabc88-9ea8-46ff-84d1-5f38d7ff16af&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=568b43ac-705c-43aa-b1ba-ae28fea95969&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:14:24 UTC	393	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:24 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 7c7198de15b1061b strict-transport-security: max-age=0 x-response-time: 77 x-connection-hash: 93b5d94ce901241945f23a1b28bca08ccbceef33a90aaa753dec70e7f4c99319 connection: close
2024-04-26 17:14:24 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
433	192.168.2.5	50399	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	581	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1632723499&_u=QACAAEAAAAAAACgEK~&z=984487653 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:24 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
434	192.168.2.5	50401	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	787	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660500&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:24 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:24 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.5	50396	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	1544	OUT	GET /pixel;r=1886673603;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151661234;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Manage%20Invoices%20with%20Xero%20Accounting%20Software%2Cdescription.Bookkeeping%20software%20that%20gets%20the%20job%20done%20online%252E%20Flexible%20features%20mean%20you%20c%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Ftry-now%2Fmanage-invoices%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=bb5959ea-f5e6-4b7e-8112-796ab74d05cc;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:14:25 UTC	282	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:24 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:14:25 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.5	50402	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	858	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660504&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:24 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=127, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=7, ullat=1 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:24 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.5	50404	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:24 UTC	895	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&rl=&if=false&ts=1714151660504&cd[utm_source]=xero-invoice&cd[utm_medium]=referral&cd[utm_campaign]=global-d-lf-xeroinvoicereferrals&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151657834&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:25 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:25 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:25 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
438	192.168.2.5	50405	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:25 UTC	1090	OUT	GET /ddm/fls/z/dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:25 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:25 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:25 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.5	50406	104.244.42.67	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:25 UTC	884	OUT	GET /i/adsct?bci=3&eci=2&event_id=70aabc88-9ea8-46ff-84d1-5f38d7ff16af&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=568b43ac-705c-43aa-b1ba-ae28fea95969&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:14:25 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:24 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 84b95bb1a6a0815c strict-transport-security: max-age=631138519 x-response-time: 12 x-connection-hash: f07c858bb04a743bdf0544b8dd746b8605b5bd4e8cf69a114b8015e6f0db1cd0 connection: close
2024-04-26 17:14:25 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.5	50407	104.244.42.69	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:25 UTC	863	OUT	GET /i/adsct?bci=3&eci=2&event_id=70aabc88-9ea8-46ff-84d1-5f38d7ff16af&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=568b43ac-705c-43aa-b1ba-ae28fea95969&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:14:25 UTC	393	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:24 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 1b8773765b78764f strict-transport-security: max-age=0 x-response-time: 80 x-connection-hash: 85607fd1df11f99bfbe5371393d65e297d74b33bb81dab7a421a94e786a9ba91 connection: close
2024-04-26 17:14:25 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
441	192.168.2.5	50408	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:25 UTC	1312	OUT	GET /pixel;r=1886673603;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151661234;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Manage%20Invoices%20with%20Xero%20Accounting%20Software%2Cdescription.Bookkeeping%20software%20that%20gets%20the%20job%20done%20online%252E%20Flexible%20features%20mean%20you%20c%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Ftry-now%2Fmanage-invoices%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=bb5959ea-f5e6-4b7e-8112-796ab74d05cc;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:14:25 UTC	354	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:25 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:14:25 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.5	50409	34.237.73.95	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:25 UTC	679	OUT	GET /pubsub/5-lply-f-VjGB-pLga11-efp0LSssuhSSwqyxVV9fMRaPOythrtG38Y2wFjZt7qmHSjq8ooW0zEhuw-bic1WNA-W0izXHhxBNjx1bP?X-Nexus-New-Client=true&X-Nexus-Version=0.12.12&user_role=visitor HTTP/1.1 Host: nexus-websocket-a.intercom.io Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://in.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: V6+FunEBPPGigzvANX3Sbw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.5	50410	142.250.217.164	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:26 UTC	1819	OUT	GET /pagead/1p-conversion/1023673485/?random=1752754579&cv=11&fst=1714151657883&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZWIECgICAw&pscrd=CMyPl7eQt6HP5wEiEwisy8jHsOCFAxWWrYMIHUwLBtQyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqOu4UZs4 [TRUNCATED] Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:26 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:26 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.5	50412	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:27 UTC	1141	OUT	POST /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=13719&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/&af=err,xhr,stn,ins,spa&be=40&fe=13629&dc=480&perf=%7B%22timing%22:%7B%22of%22:1714151652013,%22n%22:0,%22r%22:5,%22re%22:39,%22f%22:39,%22dn%22:39,%22dne%22:39,%22c%22:39,%22s%22:39,%22ce%22:39,%22rq%22:40,%22rp%22:40,%22rpe%22:77,%22di%22:462,%22ds%22:520,%22de%22:520,%22dc%22:13658,%22l%22:13659,%22le%22:13669%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=337&fcp=337 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 28 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:27 UTC	28	OUT	Data Raw: 7b 22 6a 61 22 3a 7b 22 73 69 74 65 56 65 72 73 69 6f 6e 22 3a 22 6e 65 77 22 7d 7d Data Ascii: {"ja":{"siteVersion":"new"}}
2024-04-26 17:14:27 UTC	436	IN	HTTP/1.1 200 Connection: close Content-Length: 151 date: Fri, 26 Apr 2024 17:14:27 GMT content-type: text/plain cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com access-control-expose-headers: Date timing-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760032-MIA
2024-04-26 17:14:27 UTC	151	IN	Data Raw: 7b 22 73 74 6e 22 3a 30 2c 22 65 72 72 22 3a 31 2c 22 69 6e 73 22 3a 31 2c 22 73 70 61 22 3a 31 2c 22 73 72 22 3a 30 2c 22 73 72 73 22 3a 30 2c 22 73 74 22 3a 30 2c 22 73 74 73 22 3a 30 2c 22 61 70 70 22 3a 7b 22 61 67 65 6e 74 73 22 3a 5b 7b 22 65 6e 74 69 74 79 47 75 69 64 22 3a 22 4d 54 6b 32 4d 6a 41 78 4e 33 78 43 55 6b 39 58 55 30 56 53 66 45 46 51 55 45 78 4a 51 30 46 55 53 55 39 4f 66 44 45 77 4d 6a 4d 7a 4f 44 55 78 4e 6a 41 22 7d 5d 7d 7d Data Ascii: {"stn":0,"err":1,"ins":1,"spa":1,"sr":0,"srs":0,"st":0,"sts":0,"app":{"agents":[{"entityGuid":"MTk2MjAxN3xCUk9XU0VSfEFQUExJQ0FUSU9OfDEwMjMzODUxNjA"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.5	50413	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:27 UTC	1587	OUT	GET /pagead/1p-conversion/1023673485/?random=1752754579&cv=11&fst=1714151657883&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Manage%20Invoices%20with%20Xero%20Accounting%20Software%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZWIECgICAw&pscrd=CMyPl7eQt6HP5wEiEwisy8jHsOCFAxWWrYMIHUwLBtQyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqOu4UZs4 [TRUNCATED] Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:27 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:27 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.5	50411	15.197.193.217	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:27 UTC	1423	OUT	GET /track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals HTTP/1.1 Host: insight.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFGAUoAzILCO7N1sTfh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:14:27 UTC	821	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:27 GMT Content-Type: text/html Content-Length: 846 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:27 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFGAUoAzILCOLLofHhh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB; expires=Sat, 26 Apr 2025 17:14:27 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:27 UTC	846	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 61 64 73 72 76 72 2e 6f 72 67 2f 75 6e 69 76 65 72 73 61 6c 5f 70 69 78 65 6c 2e 31 2e 31 2e 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 75 6e 69 76 65 72 73 61 6c 50 69 78 65 6c 43 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 6c 6f 62 61 6c 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <html><head> <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script></head><body> <div id="universalPixelContainer"> <script type="text/javascript"> (function(global) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.5	50414	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:27 UTC	781	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=14314&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1742 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:27 UTC	1742	OUT	Data Raw: 62 65 6c 2e 37 3b 31 2c 6c 2c 2c 62 31 69 2c 61 79 71 2c 33 30 38 2c 27 69 6e 69 74 69 61 6c 50 61 67 65 4c 6f 61 64 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 74 72 79 2d 6e 6f 77 2f 6d 61 6e 61 67 65 2d 69 6e 76 6f 69 63 65 73 2f 2c 31 2c 31 2c 2c 2c 21 21 21 21 27 65 30 61 66 61 63 62 35 2d 33 39 31 31 2d 34 37 64 33 2d 61 62 65 36 2d 36 32 33 31 31 61 62 64 65 66 39 38 2c 27 31 2c 39 64 2c 39 64 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 2c 6f 37 2c 32 77 76 2c 31 67 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 31 31 2c 21 21 21 3b 32 Data Ascii: bel.7;1,l,,b1i,ayq,308,'initialPageLoad,'https://www.xero.com/us/try-now/manage-invoices/,1,1,,,!!!!'e0afacb5-3911-47d3-abe6-62311abdef98,'1,9d,9d;5,'siteVersion,'new;2,,o7,2wv,1g,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'11,!!!;2
2024-04-26 17:14:27 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:27 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760026-MIA
2024-04-26 17:14:27 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
448	192.168.2.5	50415	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:27 UTC	896	OUT	GET /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=13719&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/&af=err,xhr,stn,ins,spa&be=40&fe=13629&dc=480&perf=%7B%22timing%22:%7B%22of%22:1714151652013,%22n%22:0,%22r%22:5,%22re%22:39,%22f%22:39,%22dn%22:39,%22dne%22:39,%22c%22:39,%22s%22:39,%22ce%22:39,%22rq%22:40,%22rp%22:40,%22rpe%22:77,%22di%22:462,%22ds%22:520,%22de%22:520,%22dc%22:13658,%22l%22:13659,%22le%22:13669%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=337&fcp=337 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:27 UTC	396	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:14:27 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * x-served-by: cache-mia-kmia1760075-MIA
2024-04-26 17:14:27 UTC	79	IN	Data Raw: 5b 37 31 2c 20 37 33 2c 20 37 30 2c 20 35 36 2c 20 35 37 2c 20 39 37 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 34 34 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 32 5d Data Ascii: [71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.5	50418	104.17.127.254	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:27 UTC	747	OUT	GET /6d78f32846d8648c/sync.gif?fck=e09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: dmp.truoptik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:28 UTC	785	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:14:28 GMT Connection: close Set-Cookie: to_master_s=218274c1cd4d3d42455bd1e574abf048; Expires=Sat, 26-Apr-25 17:14:28 GMT; Max-Age=31536000; Domain=.truoptik.com; Path=/; Secure; SameSite=None Set-Cookie: to_version_s=b2; Expires=Sat, 26-Apr-25 17:14:28 GMT; Max-Age=31536000; Domain=.truoptik.com; Path=/; Secure; SameSite=None TO-DMP-Sync: s1b-dmp-use1-aws.truoptik.com User-Agent: Tru Optik DMP 1.3.1 Cache-Control: no-store Expires: 0 Pragma: no-cache Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a835961ad29aef-MIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.5	50419	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:28 UTC	534	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=14314&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:28 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:28 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760042-MIA
2024-04-26 17:14:28 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
451	192.168.2.5	50420	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:29 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: wqh0QlLr0qJJnxiz1q/Njw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:14:29 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:14:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:14:29 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
452	192.168.2.5	50421	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:29 UTC	1201	OUT	GET /track/cmf/generic?ttd_pid=yjn0gup HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFGAUoAzILCOLLofHhh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:14:29 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:29 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:29 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFGAUgASgDMgsI4suh8eGH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:14:29 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:29 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.5	50422	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:29 UTC	1201	OUT	GET /track/cmf/generic?ttd_pid=addthis HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFGAUoAzILCOLLofHhh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:14:30 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:30 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:30 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFGAUgASgDMgsI4suh8eGH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:14:30 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:30 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.5	50423	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:31 UTC	1378	OUT	GET /js_tracking?url=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F&uid=XVsUfradtXcBUl5XS45ldg&v=1&host=https%3A%2F%2Fwww.xero.com HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:32 UTC	242	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:14:32 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.5	50428	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:35 UTC	797	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=22061&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 402 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:35 UTC	402	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 39 64 2c 31 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 65 2c 27 66 63 70 2c 39 64 2c 31 3b 35 2c 31 2c 32 3b 65 2c 27 6c 6f 61 64 2c 61 6a 70 2c 32 3b 36 2c 27 63 6c 73 2c 30 2e 31 30 30 39 34 39 34 38 37 35 30 38 39 39 39 30 38 3b 35 2c 31 2c 32 3b 65 2c 27 6c 63 70 2c 63 74 2c 39 3b 36 2c 27 73 69 7a 65 2c 32 33 36 31 39 36 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 65 6c 55 72 6c 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 64 61 6d 2f 78 65 72 6f 2f 70 69 6c 6f 74 2d 69 6d 61 67 65 73 2f 66 65 61 74 75 72 65 73 2f 69 6e 76 6f 69 63 69 6e 67 2f 63 72 65 61 74 65 2d 61 6e 64 2d 73 65 6e 64 2d 69 6e 76 6f 69 63 65 73 2e 31 36 34 36 38 37 37 34 36 34 38 31 38 Data Ascii: bel.6;e,'fp,9d,1;5,'siteVersion,'new;e,'fcp,9d,1;5,1,2;e,'load,ajp,2;6,'cls,0.10094948750899908;5,1,2;e,'lcp,ct,9;6,'size,236196.;5,'eid;5,'elUrl,'https://www.xero.com/content/dam/xero/pilot-images/features/invoicing/create-and-send-invoices.1646877464818
2024-04-26 17:14:35 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:35 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760041-MIA
2024-04-26 17:14:35 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.5	50429	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:35 UTC	800	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=22063&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1031 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:35 UTC	1031	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 56 65 72 73 69 6f 6e 2f 31 2e 32 33 36 2e 30 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 4c 6f 61 64 65 72 54 79 70 65 2f 73 70 61 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 43 44 4e 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 Data Ascii: {"sm":[{"params":{"name":"Generic/Version/1.236.0/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/LoaderType/spa/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/DistMethod/CDN/Detected"},"stats":{"c":1}},{"params":{"name":"API/setCustomAttri
2024-04-26 17:14:35 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:35 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760037-MIA
2024-04-26 17:14:35 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
457	192.168.2.5	50427	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:35 UTC	836	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151674061&i=gtm&dwt=8378&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:35 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:35 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,e6c6daf9c861b932a34a74b2a9986a51,10.0.0.207,62700,102.129.152.220,,361522217711,1,1714151675.635,0.002,,.,0,0,0.000,0.000,-,0,0,203,216,108,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.5	50430	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:35 UTC	800	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=22113&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 6381 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:35 UTC	6381	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 33 30 39 39 33 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 33 37 37 35 Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/_next/data/1712725399/us.json","method":"GET","status":200},"metrics":{"count":1,"txSize":{"t":0},"rxSize":{"t":30993},"duration":{"t":3775
2024-04-26 17:14:35 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:35 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760087-MIA
2024-04-26 17:14:35 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.5	50431	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:35 UTC	798	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=22116&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1688 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:35 UTC	1688	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 6f 37 2c 32 77 76 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 6f 39 2c 32 79 61 2c 2c 2c 30 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2f 73 69 67 6e 75 70 2e 6a 73 6f 6e 2c 2c 62 37 64 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 6b 77 2c 33 33 69 2c 2c 2c 27 50 4f 53 54 2c 35 6b 2c 27 78 65 72 6f 6c 69 6d 69 74 65 64 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 3a 34 34 33 2c 27 2f 72 65 73 74 2f 76 31 2f 64 65 6c Data Ascii: bel.7;2,1,o7,2wv,,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'0,!!!;5,'siteVersion,'new;2,1,o9,2ya,,,0,5k,1,'/_next/data/1712725399/us/signup.json,,b7d,1,3,!!!;5,4,5;2,1,kw,33i,,,'POST,5k,'xerolimited.tt.omtrdc.net:443,'/rest/v1/del
2024-04-26 17:14:35 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:35 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760036-MIA
2024-04-26 17:14:35 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
460	192.168.2.5	50432	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:35 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151674516 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 401 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:35 UTC	401	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 37 34 35 31 36 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 68 61 73 68 3d 26 63 5f 68 6f 73 74 3d 77 77 77 2e 78 65 72 6f 2e 63 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151674516&d_rtbd=json&d_jsonv=1&d_dst=1&c_hash=&c_host=www.xero.co
2024-04-26 17:14:36 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:36 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: QFmQmZS7RlQ= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-0e2482831.edge-usw2.demdex.com 4 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:36 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:36 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:36 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 51 46 6d 51 6d 5a 53 37 52 6c 51 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"QFmQmZS7RlQ="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
461	192.168.2.5	50433	63.140.39.93	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:35 UTC	734	OUT	POST /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive Content-Length: 374 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" pragma: no-cache sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain accept: / cache-control: no-cache sec-ch-ua-platform: "Windows" Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:35 UTC	374	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 68 61 6e 6e 65 6c 22 3a 22 77 65 62 22 2c 22 61 64 64 72 65 73 73 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 2f 22 2c 22 72 65 66 65 72 72 69 6e 67 55 72 6c 22 3a 22 22 7d 7d 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 78 70 65 72 69 65 6e 63 65 43 6c 6f 75 64 22 3a 7b 22 61 75 64 69 65 6e 63 65 Data Ascii: {"context":{"channel":"web","address":{"url":"https://www.xero.com/us/pricing-plans/","referringUrl":""}},"id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"experienceCloud":{"audience
2024-04-26 17:14:36 UTC	838	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:36 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://www.xero.com access-control-allow-credentials: true x-request-id: a69d6ae6-1a22-4f8e-8e33-0b5f8e98abaf timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:36 UTC	360	IN	Data Raw: 31 35 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 63 61 38 66 61 65 30 38 2d 62 34 34 31 2d 34 61 34 62 2d 61 65 31 66 2d 35 34 33 35 66 33 30 63 38 34 34 30 22 2c 22 63 6c 69 65 6e 74 22 3a 22 78 65 72 6f 6c 69 6d 69 74 65 64 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 2e 33 34 5f 30 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 34 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 Data Ascii: 15c{"status":200,"requestId":"ca8fae08-b441-4a4b-ae1f-5435f30c8440","client":"xerolimited","id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651.34_0","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"edgeHost":"mboxedge34.tt.omtrdc.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
462	192.168.2.5	50435	13.249.98.6	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:36 UTC	1188	OUT	GET /stats/TrustboxImpression?locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=4becd84a00006400050b6782&widgetId=53aa8912dec7e10d38f59f36 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:36 UTC	459	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Fri, 26 Apr 2024 17:14:35 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a5933b9e55bd48dbddd12a2ba8695eb4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: iD9Ia-NSrPJ6mLi3TEJKviJQ83I8tqeUCqyVQhOktO00yXqJlLcppQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
463	192.168.2.5	50434	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:36 UTC	604	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151674061&i=gtm&dwt=8378&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:36 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:36 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,071fff504a2710562aef63c7bda7d0e6,10.0.0.207,59248,102.129.152.220,,361522222056,1,1714151676.345,0.001,,.,0,0,0.000,0.000,-,0,0,203,192,96,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
464	192.168.2.5	50438	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:38 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151674707 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 248 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:38 UTC	248	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 37 34 37 30 37 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 65 66 65 72 72 65 72 3d 6e 6f 74 2d 78 65 72 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151674707&d_rtbd=json&d_jsonv=1&d_dst=1&c_referrer=not-xero
2024-04-26 17:14:38 UTC	989	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:38 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: tGihGBFwSf4= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-0c3b735cf.edge-usw2.demdex.com 261 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:38 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:38 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:38 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 74 47 69 68 47 42 46 77 53 66 34 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"tGihGBFwSf4="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
465	192.168.2.5	50441	63.140.39.93	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:38 UTC	445	OUT	GET /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:38 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Fri, 26 Apr 2024 17:14:38 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:38 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-26 17:14:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
466	192.168.2.5	50440	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:38 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151674516 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:38 UTC	892	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:38 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: dqx9ZQ7TRng= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-076be972a.edge-va6.demdex.com 10 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:38 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:38 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
467	192.168.2.5	50426	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:38 UTC	1220	OUT	GET /events.js HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:38 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:38 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=5
2024-04-26 17:14:38 UTC	16192	IN	Data Raw: 34 36 34 36 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 77 29 20 7b 0a 20 20 2f 2f 20 42 65 67 69 6e 20 64 6f 63 0a 0a 20 20 76 61 72 20 69 73 5f 64 65 76 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 66 61 6c 73 65 20 29 20 7b 0a 20 20 20 20 69 73 5f 64 65 76 20 3d 20 74 72 75 65 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 74 72 75 65 20 29 20 7b 0a 20 20 20 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 74 72 75 65 0a 20 20 7d 0a 0a 20 20 76 61 72 20 74 69 70 20 3d 20 22 49 78 48 61 79 48 5f 79 53 45 48 79 50 79 54 5f 58 58 72 31 77 30 46 6b 49 42 39 69 55 6c 63 4b 58 47 31 4a 4c 43 33 77 72 54 51 22 0a 20 20 0a 20 20 76 61 72 20 75 73 65 72 49 64 43 6f 6f 6b 69 65 Data Ascii: 4646(function (w) { // Begin doc var is_dev = false; if ( false ) { is_dev = true; } var disable_sync = false; if ( true ) { disable_sync = true } var tip = "IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ" var userIdCookie
2024-04-26 17:14:38 UTC	1806	IN	Data Raw: 69 66 28 22 22 21 3d 63 61 6d 70 43 6f 6f 6b 69 65 4e 61 6d 65 29 74 72 79 7b 43 6f 6f 6b 69 65 73 2e 65 78 70 69 72 65 43 61 6d 70 61 69 67 6e 43 6f 6f 6b 69 65 73 28 34 29 2c 73 65 74 43 61 6d 70 61 69 67 6e 43 6f 6f 6b 69 65 28 29 2c 65 78 70 69 72 65 43 61 6d 70 61 69 67 6e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 28 29 2c 73 65 74 43 61 6d 70 61 69 67 6e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 69 66 28 22 22 21 3d 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 61 6c 75 65 26 26 43 6f 6f 6b 69 65 73 2e 67 65 74 28 22 73 61 2d 75 73 65 72 2d 69 64 22 29 21 3d 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 61 6c 75 65 29 74 72 79 7b 73 65 74 55 73 65 72 49 64 43 6f 6f 6b 69 65 28 29 2c 73 65 74 55 73 65 72 49 64 43 6f 6f 6b 69 65 56 32 28 Data Ascii: if(""!=campCookieName)try{Cookies.expireCampaignCookies(4),setCampaignCookie(),expireCampaignLocalStorage(),setCampaignLocalStorage()}catch(e){}if(""!=userIdCookieValue&&Cookies.get("sa-user-id")!=userIdCookieValue)try{setUserIdCookie(),setUserIdCookieV2(
2024-04-26 17:14:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
468	192.168.2.5	50453	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	1119	OUT	GET /up_loader.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFGAUgASgDMgsI4suh8eGH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE. If-None-Match: "d6f0435164aefe6cf324147b77c7b6bb" If-Modified-Since: Thu, 25 Apr 2024 19:49:47 GMT
2024-04-26 17:14:39 UTC	459	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 25 Apr 2024 19:52:55 GMT Last-Modified: Thu, 25 Apr 2024 19:49:47 GMT ETag: "d6f0435164aefe6cf324147b77c7b6bb" x-amz-server-side-encryption: AES256 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 abfdb991e32ec37dabb2e5394e448bc6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: 0iPWwcgK3jLZpgq8tvn0J7quKR_K__d5YoiWCv5wafj1905x3zD7mQ== Age: 76905

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
469	192.168.2.5	50455	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	820	OUT	POST /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&page_title=Pricing%20Plans%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive Content-Length: 63 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151659\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:39 UTC	63	OUT	Data Raw: 7b 22 73 72 63 22 3a 22 74 61 67 22 2c 22 61 75 74 68 22 3a 22 42 47 43 53 44 6b 35 4c 45 48 4f 34 4d 50 56 70 67 44 52 4e 75 50 75 65 33 4d 4a 56 35 47 75 64 4d 31 70 30 45 49 42 6b 22 7d Data Ascii: {"src":"tag","auth":"BGCSDk5LEHO4MPVpgDRNuPue3MJV5GudM1p0EIBk"}
2024-04-26 17:14:39 UTC	951	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Content-Length: 3740 Connection: close Date: Fri, 26 Apr 2024 17:14:39 GMT Server: nginx Access-Control-Allow-Origin: https://www.xero.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: x-amz-cf-id Access-Control-Max-Age: 7200 Access-Control-Allow-Credentials: true Api-Version: v2 Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Identification-Source: CACHE Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 25 Apr 2024 17:14:39 GMT Vary: Accept-Encoding, Origin Request-ID: 38960b4e-feb1-41bb-99df-0efd4508541e X-Cache: Miss from cloudfront Via: 1.1 f871628c211968108daec18c331ed47c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: 3HVxihCj9z-NsbV_A3f5cyzzgj6IDVEBNMoNRrZQ35otNN7DpW1ofw==
2024-04-26 17:14:39 UTC	3740	IN	Data Raw: 7b 22 68 71 22 3a 7b 22 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 64 65 6d 61 6e 64 62 61 73 65 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 61 6c 69 61 73 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 69 6e 64 75 73 74 72 79 22 3a 22 42 75 73 69 6e 65 73 73 20 53 65 72 76 69 63 65 73 22 2c 22 73 75 62 5f 69 6e 64 75 73 74 72 79 22 3a 22 47 65 6e 65 72 61 6c 22 2c 22 65 6d 70 6c 6f 79 65 65 5f 63 6f 75 6e 74 22 3a 32 31 38 34 2c 22 70 72 69 6d 61 72 79 5f 73 69 63 22 3a 22 37 33 38 39 22 2c 22 70 72 69 6d 61 72 79 5f 6e 61 69 63 73 22 3a 6e 75 6c 6c 2c 22 73 74 72 65 65 74 5f 61 64 64 72 65 73 73 22 3a 22 35 39 35 20 53 20 38 30 20 45 20 53 74 65 20 33 30 30 22 2c 22 63 69 74 79 Data Ascii: {"hq":{"company_name":"Conservice","demandbase_sid":27340206,"marketing_alias":"Conservice","industry":"Business Services","sub_industry":"General","employee_count":2184,"primary_sic":"7389","primary_naics":null,"street_address":"595 S 80 E Ste 300","city

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
470	192.168.2.5	50449	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	910	OUT	GET /rp.gif?ts=1714151675449&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:39 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:39 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
471	192.168.2.5	50450	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	910	OUT	GET /rp.gif?ts=1714151675451&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:39 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:39 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
472	192.168.2.5	50447	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	1398	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:39 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:39 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
473	192.168.2.5	50445	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	1387	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:39 UTC	1268	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
474	192.168.2.5	50451	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	1350	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:39 UTC	1231	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
475	192.168.2.5	50456	34.96.71.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	782	OUT	GET /s/sync?exc=lr HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151659\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:40 UTC	510	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET,OPTIONS Content-Type: text/html; charset=UTF-8 Set-Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1714151680\|ix:0\|mctv:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Fri, 26 Apr 2024 17:14:40 GMT Content-Length: 74 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:40 UTC	74	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Pixels</title></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
476	192.168.2.5	50459	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	3210	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:39 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 138 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:39 UTC	138	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
477	192.168.2.5	50460	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	3166	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9d [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:39 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:39 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
478	192.168.2.5	50458	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151674707 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:39 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:39 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: imwpPTVvQoI= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-0200580d4.edge-va6.demdex.com 7 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:39 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:39 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
479	192.168.2.5	50461	108.157.173.76	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	588	OUT	GET /c/hotjar-3197823.js?sv=6 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: W/bfe92acfb0373750d6837a557751cf19
2024-04-26 17:14:39 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:14:39 GMT Access-Control-Allow-Origin: * Cache-Control: max-age=60 Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff ETag: W/bfe92acfb0373750d6837a557751cf19 Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 d6c3d8e2bcf9b0f41a443121af4c96bc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: 8mh4NnVNRzsigFyE-uCnpCXmH81xdt15P4v6QheqqNYY9CM962k5eA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
480	192.168.2.5	50446	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	1457	OUT	GET /td/rul/1023673485?random=1714151677802&cv=11&fst=1714151677802&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:39 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:39 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
481	192.168.2.5	50452	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	1361	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:39 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:39 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
482	192.168.2.5	50465	13.32.87.128	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	635	OUT	GET /bg9s?x-amz-cf-id=3HVxihCj9z-NsbV_A3f5cyzzgj6IDVEBNMoNRrZQ35otNN7DpW1ofw==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:40 UTC	601	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 26 Apr 2024 09:25:13 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 80677c288b4024a45c671874b4fa625a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: OLhaOSodI3F6nOOY3_4xWpSl_qPJjV6Td0979HlhQNvzsZZ4gdHD5w== Age: 28168 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
483	192.168.2.5	50467	13.35.116.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	561	OUT	GET /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&page_title=Pricing%20Plans%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151659\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:40 UTC	491	IN	HTTP/1.1 401 Unauthorized Content-Type: text/plain;charset=utf-8 Content-Length: 12 Connection: close Date: Fri, 26 Apr 2024 17:14:40 GMT Server: nginx WWW-Authenticate: DemandBase API v2 X-Content-Type-Options: nosniff Request-ID: 228198e5-9afa-48cf-ad4e-122b5992da83 Vary: Origin X-Cache: Error from cloudfront Via: 1.1 880eb84cefca849ee159a7c4d89c31ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: 7IXvuSPpKfjyeUIKylwllevIwtMd_MeOWa4FYUEEFb8LEphJw9e8ug==
2024-04-26 17:14:40 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
484	192.168.2.5	50468	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	678	OUT	GET /rp.gif?ts=1714151675449&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:40 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:40 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
485	192.168.2.5	50469	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:39 UTC	678	OUT	GET /rp.gif?ts=1714151675451&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:40 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:40 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
486	192.168.2.5	50471	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	3012	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:40 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 138 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:14:40 UTC	138	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
487	192.168.2.5	50472	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	2968	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=IxHayH_ySEHyPyT_XXr1w0FkIB9iUlcKXG1JLC3wrTQ&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9d [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:40 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:14:40 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
488	192.168.2.5	50473	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	1421	OUT	GET /activityi;dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:40 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:40 GMT Expires: Fri, 26 Apr 2024 17:14:40 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:40 UTC	592	IN	Data Raw: 32 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4e 4f 78 31 73 2d 77 34 49 55 44 46 54 Data Ascii: 2f8<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CNOx1s-w4IUDFT
2024-04-26 17:14:40 UTC	175	IN	Data Raw: 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 70 73 63 64 6c 3d 6e 6f 61 70 69 3b 67 74 6d 3d 34 35 66 65 34 34 6f 30 7a 38 38 33 30 39 32 33 34 37 30 7a 61 32 30 31 3b 67 63 64 3d 31 33 6c 33 6c 33 6c 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>
2024-04-26 17:14:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
489	192.168.2.5	50470	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	1384	OUT	GET /activityi;dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:40 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:40 GMT Expires: Fri, 26 Apr 2024 17:14:40 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:40 UTC	592	IN	Data Raw: 32 64 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4b 48 57 31 73 2d 77 34 49 55 44 46 66 Data Ascii: 2d3<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CKHW1s-w4IUDFf
2024-04-26 17:14:40 UTC	138	IN	Data Raw: 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 6d 61 74 63 68 5f 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>
2024-04-26 17:14:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
490	192.168.2.5	50474	146.75.124.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	625	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "bbbcf811d8437a575d796a4c1e5d4fad" If-Modified-Since: Thu, 04 Apr 2024 00:26:35 GMT
2024-04-26 17:14:40 UTC	339	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:14:40 GMT Cache-Control: no-cache ETag: "bbbcf811d8437a575d796a4c1e5d4fad" X-Served-By: cache-mia-kmia1760058-MIA X-Cache: HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
491	192.168.2.5	50477	13.32.87.74	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	437	OUT	GET /bg9s?x-amz-cf-id=3HVxihCj9z-NsbV_A3f5cyzzgj6IDVEBNMoNRrZQ35otNN7DpW1ofw==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:40 UTC	560	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 1d70b90303ff56b86662db87683a2a04.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: NswRCGrAdmm8V5x7gVQvRDv55i8fGerU4rqRtlTe-pIgru2L9k6xNw== Age: 71217 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
492	192.168.2.5	50478	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	685	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:40 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:40 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,6da95aeef5810d71497232f934fc64d5,10.0.0.207,18908,102.129.152.220,,361522249297,1,1714151680.866,0.002,,.,0,0,0.000,0.000,-,0,0,203,151,75,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
493	192.168.2.5	50479	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	1351	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:40 UTC	2220	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"105434152314562811","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_type [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:40 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
494	192.168.2.5	50480	67.220.226.233	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:40 UTC	652	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151679299 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:14:41 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:14:41 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: JK895JRWMNQB1W1AZCYV Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:14:41 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:14:41 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:14:41 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
495	192.168.2.5	50481	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1175	OUT	GET /ddm/fls/z/dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:41 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
496	192.168.2.5	50483	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1337	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: not-navigation-source, trigger, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:41 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"14489880419742023210","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:41 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
497	192.168.2.5	50486	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	453	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:41 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:41 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,995cf24fed2037663e5546e96848b238,10.0.0.207,61636,102.129.152.220,,232623905954,1,1714151681.532,0.003,,.,0,0,0.000,0.004,-,0,0,203,194,97,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
498	192.168.2.5	50485	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	932	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151678082&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&st=1714151678082&et=1714151678082&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; receive-cookie-deprecation=1; uuid2=2808008891046894518
2024-04-26 17:14:41 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:14:41 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:14:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
499	192.168.2.5	50488	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1379	OUT	GET /pixel;r=329650982;labels=_fp.event.Plans;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151678117;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Pricing%20Plans%2Cdescription.Find%20a%20Xero%20pricing%20plan%20to%20suit%20your%20business%252E%20All%20plans%20cover%20the%20accounting%20e%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Fpricing-plans%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=eeeb9e67-23d1-4903-8cb1-0a8f45ce2880;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:14:41 UTC	282	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:41 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:14:41 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
500	192.168.2.5	50487	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	673	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=Cq0qGiA5A3jjOPR2tEI1YVHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:14:41 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=nrkRjjoFwgCwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:14:41 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:14:41 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:14:41 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
501	192.168.2.5	50484	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	885	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A38%20GMT&n=-2d&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:14:41 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:41 GMT Expires: Fri, 26 Apr 2024 17:14:41 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:14:41 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:14:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
502	192.168.2.5	50489	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1064	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:41 UTC	2220	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"105434152314562811","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_type [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:41 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
503	192.168.2.5	50490	142.250.189.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 134 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:41 UTC	134	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 30 35 34 33 34 31 35 32 33 31 34 35 36 32 38 31 31 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"105434152314562811"},"type":"trigger-no-matching-source"}]
2024-04-26 17:14:41 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:14:41 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
504	192.168.2.5	50482	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1212	OUT	GET /ddm/fls/z/dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:41 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
505	192.168.2.5	50491	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	693	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151679299 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Attribution-Reporting-Eligible: trigger=navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:14:41 GMT x-amzn-RequestId: 06671b42-3ea4-4594-a88e-194707ed6556 Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Access-Control-Allow-Credentials: true X-Cache: Miss from cloudfront Via: 1.1 1da0abf50a5fdf7ae338fbc8547b31e6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: RaDcHixpZlRoPMjZWA9JvWUh0UU5qxJHcnJr7mRaKFKbxYH1POvaJw==
2024-04-26 17:14:42 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
506	192.168.2.5	50494	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	868	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678129&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3401, tp=-1, tpl=-1, uplat=2, ullat=1 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:41 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
507	192.168.2.5	50496	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	983	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678129&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger, not-navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:42 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:42 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:14:42 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
508	192.168.2.5	50492	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	928	OUT	GET /ddm/fls/z/dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
509	192.168.2.5	50495	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1027	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:42 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"14489880419742023210","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
510	192.168.2.5	50499	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	897	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678132&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=124, rtx=0, c=10, mss=1277, tbw=3404, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:42 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
511	192.168.2.5	50501	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1007	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678132&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source=navigation-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:42 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:42 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:14:42 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
512	192.168.2.5	50500	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	1147	OUT	GET /pixel;r=329650982;labels=_fp.event.Plans;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151678117;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Pricing%20Plans%2Cdescription.Find%20a%20Xero%20pricing%20plan%20to%20suit%20your%20business%252E%20All%20plans%20cover%20the%20accounting%20e%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Fpricing-plans%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=eeeb9e67-23d1-4903-8cb1-0a8f45ce2880;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:14:42 UTC	354	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:42 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:14:42 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
513	192.168.2.5	50502	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:41 UTC	548	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151678082&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&st=1714151678082&et=1714151678082&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=2808008891046894518
2024-04-26 17:14:42 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:14:42 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:14:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
514	192.168.2.5	50498	172.217.3.70	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 34 34 38 39 38 38 30 34 31 39 37 34 32 30 32 33 32 31 30 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"14489880419742023210"},"type":"trigger-no-matching-source"}]
2024-04-26 17:14:42 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:14:42 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
515	192.168.2.5	50497	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	653	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A38%20GMT&n=-2d&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:14:42 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:42 GMT Expires: Fri, 26 Apr 2024 17:14:42 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:14:42 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
516	192.168.2.5	50493	52.94.222.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	481	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151679299 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:14:42 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:14:42 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: DYERNT888YGP0FTKESPQ Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:14:42 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:14:42 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:14:42 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
517	192.168.2.5	50505	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	965	OUT	GET /ddm/fls/z/dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
518	192.168.2.5	50506	104.244.42.133	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	981	OUT	GET /i/adsct?bci=3&eci=2&event_id=107c607a-1abb-4d03-8300-33593e2a466e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dd9ecd43-3985-4a8b-8c7b-4423c019b1ca&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:14:42 UTC	393	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:42 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 72b9726cf080f7dc strict-transport-security: max-age=0 x-response-time: 10 x-connection-hash: 171b93411117debffdf65ade6669b3cec31b4db8c778d41ac7d753b0bb665ebb connection: close
2024-04-26 17:14:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
519	192.168.2.5	50507	104.244.42.195	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	1002	OUT	GET /i/adsct?bci=3&eci=2&event_id=107c607a-1abb-4d03-8300-33593e2a466e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dd9ecd43-3985-4a8b-8c7b-4423c019b1ca&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:14:42 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:42 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: edfb77d1d91d1119 strict-transport-security: max-age=631138519 x-response-time: 80 x-connection-hash: c2115f89ebf8c65afa15e8734ae32897d07aad402bbfaee9455d5233c6bb7ed3 connection: close
2024-04-26 17:14:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
520	192.168.2.5	50508	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	636	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678129&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3403, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:42 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
521	192.168.2.5	50510	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	673	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678129&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:42 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:42 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
522	192.168.2.5	50509	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	436	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151679299 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	378	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:14:42 GMT x-amzn-RequestId: 1307c2fc-aa8c-41c4-8127-b51300e6c117 X-Cache: Miss from cloudfront Via: 1.1 0e29dbf2290a532921c8437d0713b55c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: ozRxPUDEJvpU5dFRUIO1ZRPBdA88E0dlNUOCq82W4gZYuPeDOFUb0g==
2024-04-26 17:14:42 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
523	192.168.2.5	50511	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	665	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678132&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=1, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:42 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
524	192.168.2.5	50514	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	702	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151678132&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151677618&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:42 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:42 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
525	192.168.2.5	50504	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	441	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=nrkRjjoFwgCwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:14:43 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=p2jiJ1gSgsCwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:14:42 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:14:42 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:14:42 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
526	192.168.2.5	50512	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: F/oen+jsJWJznZ8CkCghsQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:14:43 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:14:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:14:43 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
527	192.168.2.5	50515	99.80.149.126	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	627	OUT	POST /?site_id=3197823&gzip=1 HTTP/1.1 Host: content.hotjar.io Connection: keep-alive Content-Length: 32626 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain; charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:42 UTC	16384	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a ec bd eb 76 db 48 96 2e f8 2a 18 cf 29 57 b7 c7 a4 10 77 44 f6 78 6a 6c fa a6 4c df d2 92 33 d3 9e 3a cb 0b 24 41 09 16 49 d0 00 a8 8b 7b 7a ad 7e 87 f9 75 fe 9d bf f3 1a f3 28 fd 24 b3 77 80 a4 08 81 14 03 12 00 ca 36 9d 55 14 83 08 44 ec b8 ec 4b ec d8 f1 c5 bf df eb 47 bd c3 8b 49 70 ef 97 7b ff fb ff f2 f4 6d e7 f0 e3 bb 67 ce 71 3a 1a fe 1f ff 1c df 7b 78 2f 8e a2 74 bf 7f ef 17 f2 f0 5e ef 38 1c f6 e3 60 7c ef 97 ff eb df ef 8d a3 7e 90 bd 46 dc 87 f7 42 c8 41 1f de 1b fb 23 2c 07 df 86 57 27 d3 ee 30 ec e1 cb f7 20 95 5c 24 69 30 ca 52 ff f1 30 57 40 f6 3e 7b 78 2f f5 8f de 64 45 bc 3c 7c fd 0a 5e f2 d3 34 0e bb d3 34 48 ee fd f2 ef f7 86 fe f8 08 9e 01 05 ff 31 a3 e6 0d 14 92 5c a5 27 2b 8e e7 8a 7b f6 f8 e9 d5 e2 2c Data Ascii: vH.*)WwDxjlL3:$AI{z~u($w6UDKGIp{mgq:{x/t^8`\|~FBA#,W'0 \$i0R0W@>{x/dE<\|^44H1\'+{,
2024-04-26 17:14:42 UTC	16242	OUT	Data Raw: a7 54 b3 73 6e d6 2a d5 ca 7b 37 bd 1a bc 9b 45 9c 93 8d 52 8d 59 7a 37 7f 50 a9 c6 2c cf b6 ff e0 52 8d 35 79 22 5d b1 6d 9d 48 57 ec bb 39 91 ee 6d df 25 cb ca 9f 48 f7 6a 70 c9 b2 d2 27 d2 15 db 9d 48 af c5 25 cb 9a 3d 91 ae f8 f6 4e a4 2b be 95 13 e9 8a 6f f7 44 ba e2 5b 3b 91 ae f8 ee 44 fa a2 2b 76 27 d2 7f 22 97 2c df 9d 48 5f d5 2b 5b 3d 91 ae f8 5d 39 91 ae 78 e1 44 fa 61 ec f7 4e 9c 49 1c 7d 09 7a e9 66 4f ac b8 fd b1 f4 12 3e 8b 3c 94 4b 93 d6 bd a8 f8 58 7a 7d 3e 0b 7d 07 3c b1 a2 fc b9 74 5d 83 27 56 14 ce a5 6f f4 59 94 c0 6b f9 11 7d 16 d6 00 26 3f b6 cf 42 dc 1e 65 b3 8c 54 db 16 ca a6 12 15 a3 6c d6 29 d5 b6 ef 89 95 e5 61 36 75 0d 9e 58 59 80 d9 dc 28 d5 a4 ad 2b f2 c7 94 6a 79 98 94 9f 56 aa c9 26 ef 11 52 72 5b f7 08 29 f9 dd dc 23 a4 Data Ascii: Tsn*{7ERYz7P,R5y"]mHW9m%Hjp'H%=N+oD[;D+v'",H_+[=]9xDaNI}zfO><KXz}>}<t]'VoYk}&?BeTl)a6uXY(+jyV&Rr[)#
2024-04-26 17:14:43 UTC	190	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:43 GMT Content-Type: application/json Content-Length: 56 Connection: close Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400
2024-04-26 17:14:43 UTC	56	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 5f 75 75 69 64 22 3a 22 41 4b 48 59 77 77 72 48 53 4c 6d 41 57 39 34 64 78 33 51 79 63 51 22 2c 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d Data Ascii: {"content_uuid":"AKHYwwrHSLmAW94dx3QycQ","success":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
528	192.168.2.5	50517	104.244.42.69	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:42 UTC	749	OUT	GET /i/adsct?bci=3&eci=2&event_id=107c607a-1abb-4d03-8300-33593e2a466e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dd9ecd43-3985-4a8b-8c7b-4423c019b1ca&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:14:43 UTC	392	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:42 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 82b6574aa0186444 strict-transport-security: max-age=0 x-response-time: 5 x-connection-hash: c5677fa2ff82409922e947356389dc78b8e7e82eb270eaba9f472eec0b36336f connection: close
2024-04-26 17:14:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
529	192.168.2.5	50518	104.244.42.67	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:43 UTC	770	OUT	GET /i/adsct?bci=3&eci=2&event_id=107c607a-1abb-4d03-8300-33593e2a466e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=dd9ecd43-3985-4a8b-8c7b-4423c019b1ca&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:14:43 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:42 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 58f283c36f4ee4ed strict-transport-security: max-age=631138519 x-response-time: 78 x-connection-hash: 58e52011ee360aebfebf7aca1ff9019c74b45967bb1ebf6968b8e4519ba24e46 connection: close
2024-04-26 17:14:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
530	192.168.2.5	50519	142.250.189.132	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:43 UTC	1657	OUT	GET /pagead/1p-conversion/1023673485/?random=915921965&cv=11&fst=1714151677802&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSidldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXJiBAoCAgM&pscrd=CPiLxenE4qiPnAEiEwjV4p7QsOCFAxWYqYMIHaaVAnUyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqlGVMoiYxIj-mSI3PZcfWVVBTJR6BQPBPzlg5vVwPiaRj8SuD&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaBACttocF-57JWxzXyxbGAQt0eCyO847Gg&random=2013634569 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:43 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
531	192.168.2.5	50522	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:43 UTC	1088	OUT	POST /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=8717&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/&af=err,xhr,stn,ins,spa&be=27&fe=8646&dc=328&perf=%7B%22timing%22:%7B%22of%22:1714151674009,%22n%22:0,%22f%22:3,%22dn%22:3,%22dne%22:3,%22c%22:3,%22s%22:3,%22ce%22:3,%22rq%22:13,%22rp%22:27,%22rpe%22:47,%22di%22:313,%22ds%22:355,%22de%22:355,%22dc%22:8659,%22l%22:8662,%22le%22:8673%7D,%22navigation%22:%7B%7D%7D&fp=251&fcp=251 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 28 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:43 UTC	28	OUT	Data Raw: 7b 22 6a 61 22 3a 7b 22 73 69 74 65 56 65 72 73 69 6f 6e 22 3a 22 6e 65 77 22 7d 7d Data Ascii: {"ja":{"siteVersion":"new"}}
2024-04-26 17:14:44 UTC	436	IN	HTTP/1.1 200 Connection: close Content-Length: 151 date: Fri, 26 Apr 2024 17:14:44 GMT content-type: text/plain cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com access-control-expose-headers: Date timing-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760085-MIA
2024-04-26 17:14:44 UTC	151	IN	Data Raw: 7b 22 73 74 6e 22 3a 30 2c 22 65 72 72 22 3a 31 2c 22 69 6e 73 22 3a 31 2c 22 73 70 61 22 3a 31 2c 22 73 72 22 3a 30 2c 22 73 72 73 22 3a 30 2c 22 73 74 22 3a 30 2c 22 73 74 73 22 3a 30 2c 22 61 70 70 22 3a 7b 22 61 67 65 6e 74 73 22 3a 5b 7b 22 65 6e 74 69 74 79 47 75 69 64 22 3a 22 4d 54 6b 32 4d 6a 41 78 4e 33 78 43 55 6b 39 58 55 30 56 53 66 45 46 51 55 45 78 4a 51 30 46 55 53 55 39 4f 66 44 45 77 4d 6a 4d 7a 4f 44 55 78 4e 6a 41 22 7d 5d 7d 7d Data Ascii: {"stn":0,"err":1,"ins":1,"spa":1,"sr":0,"srs":0,"st":0,"sts":0,"app":{"agents":[{"entityGuid":"MTk2MjAxN3xCUk9XU0VSfEFQUExJQ0FUSU9OfDEwMjMzODUxNjA"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
532	192.168.2.5	50523	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:44 UTC	1425	OUT	GET /pagead/1p-conversion/1023673485/?random=915921965&cv=11&fst=1714151677802&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Pricing%20Plans%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSidldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXJiBAoCAgM&pscrd=CPiLxenE4qiPnAEiEwjV4p7QsOCFAxWYqYMIHaaVAnUyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtqlGVMoiYxIj-mSI3PZcfWVVBTJR6BQPBPzlg5vVwPiaRj8SuD&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaBACttocF-57JWxzXyxbGAQt0eCyO847Gg&random=2013634569 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:44 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
533	192.168.2.5	50520	52.209.193.176	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:44 UTC	364	OUT	GET /?site_id=3197823&gzip=1 HTTP/1.1 Host: content.hotjar.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:44 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:14:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 11 Connection: close
2024-04-26 17:14:44 UTC	11	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
534	192.168.2.5	50521	15.197.193.217	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:44 UTC	1309	OUT	GET /track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: insight.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFGAUgASgDMgsI4suh8eGH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.
2024-04-26 17:14:44 UTC	917	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:44 GMT Content-Type: text/html Content-Length: 946 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFGAUoAzILCJzX45Hjh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB; expires=Sat, 26 Apr 2025 17:14:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:44 UTC	946	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 61 64 73 72 76 72 2e 6f 72 67 2f 75 6e 69 76 65 72 73 61 6c 5f 70 69 78 65 6c 2e 31 2e 31 2e 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 75 6e 69 76 65 72 73 61 6c 50 69 78 65 6c 43 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 6c 6f 62 61 6c 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <html><head> <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script></head><body> <div id="universalPixelContainer"> <script type="text/javascript"> (function(global) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
535	192.168.2.5	50525	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:44 UTC	770	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=9370&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 2303 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:44 UTC	2303	OUT	Data Raw: 62 65 6c 2e 37 3b 31 2c 74 2c 2c 37 38 35 2c 37 33 76 2c 61 68 2c 27 69 6e 69 74 69 61 6c 50 61 67 65 4c 6f 61 64 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 2f 2c 31 2c 31 2c 2c 2c 21 21 21 21 27 36 36 32 64 36 38 30 65 2d 37 37 33 62 2d 34 63 65 61 2d 39 61 30 34 2d 66 64 38 34 32 31 39 36 36 37 66 33 2c 27 31 2c 36 7a 2c 36 7a 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 2c 68 66 2c 33 31 2c 38 2c 31 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 31 31 2c 21 21 21 3b 32 2c 2c 68 67 2c 33 30 2c 62 2c 31 2c Data Ascii: bel.7;1,t,,785,73v,ah,'initialPageLoad,'https://www.xero.com/us/pricing-plans/,1,1,,,!!!!'662d680e-773b-4cea-9a04-fd84219667f3,'1,6z,6z;5,'siteVersion,'new;2,,hf,31,8,1,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'11,!!!;2,,hg,30,b,1,
2024-04-26 17:14:44 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:44 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760065-MIA
2024-04-26 17:14:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
536	192.168.2.5	50529	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:44 UTC	843	OUT	GET /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=8717&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/&af=err,xhr,stn,ins,spa&be=27&fe=8646&dc=328&perf=%7B%22timing%22:%7B%22of%22:1714151674009,%22n%22:0,%22f%22:3,%22dn%22:3,%22dne%22:3,%22c%22:3,%22s%22:3,%22ce%22:3,%22rq%22:13,%22rp%22:27,%22rpe%22:47,%22di%22:313,%22ds%22:355,%22de%22:355,%22dc%22:8659,%22l%22:8662,%22le%22:8673%7D,%22navigation%22:%7B%7D%7D&fp=251&fcp=251 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:45 UTC	396	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:14:45 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * x-served-by: cache-mia-kmia1760092-MIA
2024-04-26 17:14:45 UTC	79	IN	Data Raw: 5b 37 31 2c 20 37 33 2c 20 37 30 2c 20 35 36 2c 20 35 37 2c 20 39 37 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 34 34 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 32 5d Data Ascii: [71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
537	192.168.2.5	50526	34.98.67.3	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:44 UTC	842	OUT	GET /rcs?ns=ttd&uid3=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3D1i071nc HTTP/1.1 Host: tags.rd.linksynergy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:45 UTC	634	IN	HTTP/1.1 303 See Other Content-Type: text/html; charset=utf-8 Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=1i071nc Set-Cookie: rmuid=d1bc5876-80af-41e0-9776-add17a1c857e; Path=/; Domain=linksynergy.com; Expires=Sat, 26 Apr 2025 17:14:45 GMT; Secure; SameSite=None Set-Cookie: icts=2024-04-26T17:14:45Z; Path=/; Domain=linksynergy.com; Expires=Sat, 26 Apr 2025 17:14:45 GMT; Secure; SameSite=None X-Samesite: secure Date: Fri, 26 Apr 2024 17:14:45 GMT Content-Length: 85 Via: 1.1 google Strict-Transport-Security: max-age=31536000 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:45 UTC	85	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 2e 61 64 73 72 76 72 2e 6f 72 67 2f 74 72 61 63 6b 2f 63 6d 66 2f 67 65 6e 65 72 69 63 3f 74 74 64 5f 70 69 64 3d 31 69 30 37 31 6e 63 22 3e 53 65 65 20 4f 74 68 65 72 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://match.adsrvr.org/track/cmf/generic?ttd_pid=1i071nc">See Other</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
538	192.168.2.5	50528	3.234.43.148	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	772	OUT	GET /bct?pid=02760a75-50e3-4c64-b77b-fb5fcd04e437&_ct=img&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: mid.rkdms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:45 UTC	616	IN	HTTP/1.1 302 FOUND Server: awselb/2.0 Date: Fri, 26 Apr 2024 17:14:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close set-cookie: sc=12%3A116736; Domain=rkdms.com; Expires=Sat, 26 Apr 2025 17:14:45 GMT; Secure; Path=/; SameSite=None set-cookie: sessionid=h-8bf082a70be845d5b8394e1975e85604_t-1714151685; Domain=rkdms.com; Expires=Sat, 26 Apr 2025 17:14:45 GMT; Secure; Path=/; SameSite=None Vary: Accept-Encoding Pragma: no-cache Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Location: https://track2.securedvisit.com/sync/4974_04438

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
539	192.168.2.5	50527	50.57.31.206	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	910	OUT	GET /tradedesk/1/get?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&sInitiator=external&_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dsemasio%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:45 UTC	798	IN	HTTP/1.1 302 Found Location: /tradedesk/1/get2?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&sInitiator=external&_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dsemasio%26gdpr%3D0%26gdpr_consent%3D UIP-Response-Status: Ok Frontend-ID: 15 Set-Cookie: SEUNCY=79BF085BEDC69CF5; Expires=Sat, 26 Apr 2025 17:14:45 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Connection: close Date: Fri, 26 Apr 2024 17:14:45 GMT Content-Length: 0 Routing-Server-ID: -1 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
540	192.168.2.5	50530	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	523	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=9370&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:45 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:45 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760075-MIA
2024-04-26 17:14:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
541	192.168.2.5	50534	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	722	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151684059&i=gtm&dwt=1377&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:45 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:45 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,7bd7df8eda04ad83469998c7583521e3,10.0.0.207,16052,102.129.152.220,,232623927556,1,1714151685.629,0.001,,.,0,0,0.000,0.000,-,0,0,203,239,119,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
542	192.168.2.5	50536	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	781	OUT	POST /jserrors/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=130970&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 840 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:45 UTC	840	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 6a 61 78 2f 45 76 65 6e 74 73 2f 45 78 63 6c 75 64 65 64 2f 41 67 65 6e 74 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 33 7d 7d 5d 2c 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 65 72 72 6f 72 73 2f 31 2f 62 64 36 31 62 36 37 36 62 65 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 Data Ascii: {"sm":[{"params":{"name":"Ajax/Events/Excluded/Agent"},"stats":{"c":3}}],"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/jserrors/1/bd61b676be","status":200},"metrics
2024-04-26 17:14:45 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:45 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760092-MIA
2024-04-26 17:14:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
543	192.168.2.5	50535	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	787	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=10127&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 276 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:45 UTC	276	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 36 7a 2c 31 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 65 2c 27 66 63 70 2c 36 7a 2c 31 3b 35 2c 31 2c 32 3b 65 2c 27 6c 6f 61 64 2c 36 6f 78 2c 32 3b 36 2c 27 63 6c 73 2c 30 2e 31 30 33 31 36 33 34 33 37 38 36 39 36 30 32 31 38 3b 35 2c 31 2c 32 3b 65 2c 27 6c 63 70 2c 36 7a 2c 38 3b 36 2c 27 73 69 7a 65 2c 34 38 34 38 30 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 65 6c 54 61 67 2c 27 48 31 3b 35 2c 27 6e 65 74 2d 65 74 79 70 65 2c 27 33 67 3b 36 2c 27 6e 65 74 2d 72 74 74 2c 33 35 30 2e 3b 36 2c 27 6e 65 74 2d 64 6c 69 6e 6b 2c 31 2e 34 3b 36 2c 35 2c 30 2e 31 30 33 31 36 33 34 33 37 38 36 39 36 30 32 31 38 3b 35 2c 31 2c 32 3b 65 2c 27 70 61 67 65 48 69 64 65 2c 37 74 38 2c 32 3b 36 2c 35 2c 30 2e 31 30 Data Ascii: bel.6;e,'fp,6z,1;5,'siteVersion,'new;e,'fcp,6z,1;5,1,2;e,'load,6ox,2;6,'cls,0.10316343786960218;5,1,2;e,'lcp,6z,8;6,'size,48480.;5,'eid;5,'elTag,'H1;5,'net-etype,'3g;6,'net-rtt,350.;6,'net-dlink,1.4;6,5,0.10316343786960218;5,1,2;e,'pageHide,7t8,2;6,5,0.10
2024-04-26 17:14:45 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:45 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760065-MIA
2024-04-26 17:14:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
544	192.168.2.5	50537	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	790	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=10130&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1031 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:45 UTC	1031	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 56 65 72 73 69 6f 6e 2f 31 2e 32 33 36 2e 30 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 4c 6f 61 64 65 72 54 79 70 65 2f 73 70 61 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 43 44 4e 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 Data Ascii: {"sm":[{"params":{"name":"Generic/Version/1.236.0/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/LoaderType/spa/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/DistMethod/CDN/Detected"},"stats":{"c":1}},{"params":{"name":"API/setCustomAttri
2024-04-26 17:14:45 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:45 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760086-MIA
2024-04-26 17:14:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
545	192.168.2.5	50538	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:45 UTC	790	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=10132&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 8113 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:45 UTC	8113	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 33 30 39 39 33 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 31 30 39 7d Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/_next/data/1712725399/us.json","method":"GET","status":200},"metrics":{"count":1,"txSize":{"t":0},"rxSize":{"t":30993},"duration":{"t":109}
2024-04-26 17:14:45 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:45 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760082-MIA
2024-04-26 17:14:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
546	192.168.2.5	50542	54.234.5.56	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:46 UTC	703	OUT	GET /sync/4974_04438 HTTP/1.1 Host: track2.securedvisit.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:47 UTC	499	IN	HTTP/1.1 302 FOUND Date: Fri, 26 Apr 2024 17:14:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Server: nginx/1.24.0 Location: https://mid.rkdms.com/bct?pid=437ea0fb-a4b9-4984-a0a2-8cbfec2ccecc&puid=cce91c92ed659663e5c02bfbce595320&sha256=7ce3f6ced5cb6000d9a64547418ef36a1e1120666513a68c874bf00e643ef69b&sha1=36b9ae06c3bb2a08fe12ef798c0b97abcee8d7ed&probflag=1&score=0.07526959&_ct=img Cache-Control: private, no-cache, proxy-revalidate Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
547	192.168.2.5	50541	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:46 UTC	1297	OUT	GET /track/cmf/generic?ttd_pid=1i071nc HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFGAUoAzILCJzX45Hjh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:14:47 UTC	920	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:46 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:46 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFGAUgASgDMgsInNfjkeOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:14:46 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:47 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
548	192.168.2.5	50540	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:46 UTC	788	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=10134&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 2250 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:46 UTC	2250	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 68 66 2c 33 31 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 68 67 2c 33 30 2c 2c 2c 30 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2f 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 2e 6a 73 6f 6e 2c 2c 76 71 61 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 68 68 2c 33 30 2c 2c 2c 30 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2f 73 69 67 6e 75 70 2e 6a 73 6f 6e 2c 2c 62 37 Data Ascii: bel.7;2,1,hf,31,,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'0,!!!;5,'siteVersion,'new;2,1,hg,30,,,0,5k,1,'/_next/data/1712725399/us/pricing-plans.json,,vqa,1,3,!!!;5,4,5;2,1,hh,30,,,0,5k,1,'/_next/data/1712725399/us/signup.json,,b7
2024-04-26 17:14:47 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:47 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760099-MIA
2024-04-26 17:14:47 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
549	192.168.2.5	50539	50.57.31.206	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:47 UTC	944	OUT	GET /tradedesk/1/get2?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&sInitiator=external&_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dsemasio%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: SEUNCY=79BF085BEDC69CF5
2024-04-26 17:14:47 UTC	648	IN	HTTP/1.1 302 Found Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&gdpr=0&gdpr_consent= UIP-Response-Status: Ok Frontend-ID: 7 Set-Cookie: SEUNCY=79BF085BEDC69CF5; Expires=Sat, 26 Apr 2025 17:14:47 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Connection: close Date: Fri, 26 Apr 2024 17:14:47 GMT Content-Length: 0 Routing-Server-ID: -1 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
550	192.168.2.5	50544	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:47 UTC	1318	OUT	GET /track/cmf/generic?ttd_pid=semasio&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFGAUoAzILCJzX45Hjh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:14:48 UTC	920	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:48 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:48 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFGAUgASgDMgsInNfjkeOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:14:48 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:48 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
551	192.168.2.5	50543	63.140.39.93	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:47 UTC	734	OUT	POST /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive Content-Length: 360 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" pragma: no-cache sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain accept: / cache-control: no-cache sec-ch-ua-platform: "Windows" Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:47 UTC	360	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 68 61 6e 6e 65 6c 22 3a 22 77 65 62 22 2c 22 61 64 64 72 65 73 73 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 22 2c 22 72 65 66 65 72 72 69 6e 67 55 72 6c 22 3a 22 22 7d 7d 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 78 70 65 72 69 65 6e 63 65 43 6c 6f 75 64 22 3a 7b 22 61 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 22 3a 7b 22 6c 6f 63 Data Ascii: {"context":{"channel":"web","address":{"url":"https://www.xero.com/us/","referringUrl":""}},"id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"experienceCloud":{"audienceManager":{"loc
2024-04-26 17:14:48 UTC	838	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:48 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://www.xero.com access-control-allow-credentials: true x-request-id: 603a51a7-ddb9-4b41-a682-33e6caf9c85b timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:48 UTC	360	IN	Data Raw: 31 35 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 61 64 61 63 64 63 66 61 2d 66 64 35 33 2d 34 62 62 62 2d 38 62 37 36 2d 33 33 30 37 62 30 33 35 62 35 61 31 22 2c 22 63 6c 69 65 6e 74 22 3a 22 78 65 72 6f 6c 69 6d 69 74 65 64 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 2e 33 34 5f 30 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 34 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 Data Ascii: 15c{"status":200,"requestId":"adacdcfa-fd53-4bbb-8b76-3307b035b5a1","client":"xerolimited","id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651.34_0","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"edgeHost":"mboxedge34.tt.omtrdc.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
552	192.168.2.5	50546	3.234.43.148	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:48 UTC	997	OUT	GET /bct?pid=437ea0fb-a4b9-4984-a0a2-8cbfec2ccecc&puid=cce91c92ed659663e5c02bfbce595320&sha256=7ce3f6ced5cb6000d9a64547418ef36a1e1120666513a68c874bf00e643ef69b&sha1=36b9ae06c3bb2a08fe12ef798c0b97abcee8d7ed&probflag=1&score=0.07526959&_ct=img HTTP/1.1 Host: mid.rkdms.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc=12%3A116736; sessionid=h-8bf082a70be845d5b8394e1975e85604_t-1714151685
2024-04-26 17:14:48 UTC	424	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Fri, 26 Apr 2024 17:14:48 GMT Content-Type: image/gif Content-Length: 43 Connection: close set-cookie: sessionid=h-8bf082a70be845d5b8394e1975e85604_t-1714151685; Domain=rkdms.com; Expires=Sat, 26 Apr 2025 17:14:48 GMT; Secure; Path=/; SameSite=None Vary: Accept-Encoding Pragma: no-cache Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
2024-04-26 17:14:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
553	192.168.2.5	50545	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:48 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151686548 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 369 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:48 UTC	369	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 38 36 35 34 38 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 68 61 73 68 3d 26 63 5f 68 6f 73 74 3d 77 77 77 2e 78 65 72 6f 2e 63 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151686548&d_rtbd=json&d_jsonv=1&d_dst=1&c_hash=&c_host=www.xero.co
2024-04-26 17:14:48 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:48 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: 4zKvtkN3Tng= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-0fa569dcd.edge-usw2.demdex.com 4 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:48 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:48 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:48 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 34 7a 4b 76 74 6b 4e 33 54 6e 67 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"4zKvtkN3Tng="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
554	192.168.2.5	50548	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:48 UTC	1074	OUT	POST /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=3306&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/&af=err,xhr,stn,ins,spa&be=37&fe=2095&dc=306&perf=%7B%22timing%22:%7B%22of%22:1714151684002,%22n%22:0,%22f%22:3,%22dn%22:3,%22dne%22:3,%22c%22:3,%22s%22:3,%22ce%22:3,%22rq%22:22,%22rp%22:37,%22rpe%22:56,%22di%22:279,%22ds%22:343,%22de%22:343,%22dc%22:2082,%22l%22:2084,%22le%22:2131%7D,%22navigation%22:%7B%7D%7D&fp=106&fcp=106 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 28 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:48 UTC	28	OUT	Data Raw: 7b 22 6a 61 22 3a 7b 22 73 69 74 65 56 65 72 73 69 6f 6e 22 3a 22 6e 65 77 22 7d 7d Data Ascii: {"ja":{"siteVersion":"new"}}
2024-04-26 17:14:48 UTC	436	IN	HTTP/1.1 200 Connection: close Content-Length: 151 date: Fri, 26 Apr 2024 17:14:48 GMT content-type: text/plain cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com access-control-expose-headers: Date timing-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760062-MIA
2024-04-26 17:14:48 UTC	151	IN	Data Raw: 7b 22 73 74 6e 22 3a 30 2c 22 65 72 72 22 3a 31 2c 22 69 6e 73 22 3a 31 2c 22 73 70 61 22 3a 31 2c 22 73 72 22 3a 30 2c 22 73 72 73 22 3a 30 2c 22 73 74 22 3a 30 2c 22 73 74 73 22 3a 30 2c 22 61 70 70 22 3a 7b 22 61 67 65 6e 74 73 22 3a 5b 7b 22 65 6e 74 69 74 79 47 75 69 64 22 3a 22 4d 54 6b 32 4d 6a 41 78 4e 33 78 43 55 6b 39 58 55 30 56 53 66 45 46 51 55 45 78 4a 51 30 46 55 53 55 39 4f 66 44 45 77 4d 6a 4d 7a 4f 44 55 78 4e 6a 41 22 7d 5d 7d 7d Data Ascii: {"stn":0,"err":1,"ins":1,"spa":1,"sr":0,"srs":0,"st":0,"sts":0,"app":{"agents":[{"entityGuid":"MTk2MjAxN3xCUk9XU0VSfEFQUExJQ0FUSU9OfDEwMjMzODUxNjA"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
555	192.168.2.5	50549	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: BvZB6TR/8RQELn3V8dO+Hg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:14:49 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:14:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:14:49 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
556	192.168.2.5	50550	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151687243 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 248 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:49 UTC	248	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 38 37 32 34 33 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 65 66 65 72 72 65 72 3d 6e 6f 74 2d 78 65 72 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151687243&d_rtbd=json&d_jsonv=1&d_dst=1&c_referrer=not-xero
2024-04-26 17:14:49 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:49 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: NVgVrcY9Q1I= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-07d491493.edge-usw2.demdex.com 9 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:49 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:49 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:49 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 4e 56 67 56 72 63 59 39 51 31 49 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"NVgVrcY9Q1I="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
557	192.168.2.5	50552	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	537	OUT	GET /jserrors/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=130970&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:49 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:49 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760069-MIA
2024-04-26 17:14:49 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
558	192.168.2.5	50553	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	490	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151684059&i=gtm&dwt=1377&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:49 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:49 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,f93f0effe178374c3b08460766609c41,10.0.0.207,39938,102.129.152.220,,232877298379,1,1714151689.490,0.002,,.,0,0,0.000,0.000,-,0,0,203,129,64,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
559	192.168.2.5	50554	63.140.39.93	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	445	OUT	GET /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:49 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Fri, 26 Apr 2024 17:14:49 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:49 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-26 17:14:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
560	192.168.2.5	50533	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	1366	OUT	GET /js_tracking?url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&uid=XVsUfradtXcBUl5XS45ldg&v=1&host=https%3A%2F%2Fwww.xero.com HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:49 UTC	242	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:14:49 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
561	192.168.2.5	50555	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151686548 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:49 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:49 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: VUKVb4ObS4Y= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-0ab9f4195.edge-va6.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:49 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:49 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
562	192.168.2.5	50558	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	829	OUT	GET /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=3306&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/&af=err,xhr,stn,ins,spa&be=37&fe=2095&dc=306&perf=%7B%22timing%22:%7B%22of%22:1714151684002,%22n%22:0,%22f%22:3,%22dn%22:3,%22dne%22:3,%22c%22:3,%22s%22:3,%22ce%22:3,%22rq%22:22,%22rp%22:37,%22rpe%22:56,%22di%22:279,%22ds%22:343,%22de%22:343,%22dc%22:2082,%22l%22:2084,%22le%22:2131%7D,%22navigation%22:%7B%7D%7D&fp=106&fcp=106 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:49 UTC	396	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:14:49 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * x-served-by: cache-mia-kmia1760049-MIA
2024-04-26 17:14:49 UTC	79	IN	Data Raw: 5b 37 31 2c 20 37 33 2c 20 37 30 2c 20 35 36 2c 20 35 37 2c 20 39 37 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 34 34 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 32 5d Data Ascii: [71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
563	192.168.2.5	50559	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	719	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688247&i=gtm&dwt=1&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:49 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:49 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,5f422cd68842eaa733549c002ed46e98,10.0.0.207,26964,102.129.152.220,,361522300953,1,1714151689.827,0.006,,.,0,0,0.000,0.004,-,0,0,203,182,91,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
564	192.168.2.5	50560	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	719	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688252&i=gtm&dwt=5&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:49 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:49 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,dc56450ce83e2dde40e8b193d204d9ca,10.0.0.207,41652,102.129.152.220,,232877300642,1,1714151689.825,0.001,,.,0,0,0.000,0.000,-,0,0,203,123,61,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
565	192.168.2.5	50562	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:49 UTC	727	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688257&i=gtm&dwt=1&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:49 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:49 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,5bba1b1c44f082884c1811200382111f,10.0.0.207,41664,102.129.152.220,,232877300662,1,1714151689.830,0.002,,.,0,0,0.000,0.000,-,0,0,203,129,64,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
566	192.168.2.5	50566	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:51 UTC	1220	OUT	GET /events.js HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:52 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:51 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=5
2024-04-26 17:14:52 UTC	3918	IN	Data Raw: 66 34 37 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 77 29 20 7b 0a 20 20 2f 2f 20 42 65 67 69 6e 20 64 6f 63 0a 0a 20 20 76 61 72 20 69 73 5f 64 65 76 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 66 61 6c 73 65 20 29 20 7b 0a 20 20 20 20 69 73 5f 64 65 76 20 3d 20 74 72 75 65 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 74 72 75 65 20 29 20 7b 0a 20 20 20 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 74 72 75 65 0a 20 20 7d 0a 0a 20 20 76 61 72 20 74 69 70 20 3d 20 22 41 5f 51 37 73 34 75 6e 47 54 6e 59 6d 2d 59 50 56 63 74 66 32 34 50 74 39 47 38 4b 4b 56 67 35 68 57 34 45 59 69 49 6f 68 4a 4d 22 0a 20 20 0a 20 20 76 61 72 20 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 Data Ascii: f47(function (w) { // Begin doc var is_dev = false; if ( false ) { is_dev = true; } var disable_sync = false; if ( true ) { disable_sync = true } var tip = "A_Q7s4unGTnYm-YPVctf24Pt9G8KKVg5hW4EYiIohJM" var userIdCookieV
2024-04-26 17:14:52 UTC	14087	IN	Data Raw: 33 36 66 66 0d 0a 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 63 75 72 72 65 6e 74 5f 77 69 6e 64 6f 77 5f 75 72 6c 5f 70 61 72 61 6d 26 26 63 75 72 72 65 6e 74 5f 77 69 6e 64 6f 77 5f 75 72 6c 5f 70 61 72 61 6d 2e 69 6e 64 65 78 4f 66 28 67 6c 6f 62 61 6c 73 2e 73 61 5f 64 65 62 75 67 5f 6b 65 79 29 3e 2d 31 26 26 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 53 41 2f 52 54 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 4c 61 6c 28 65 29 7b 72 65 74 75 72 6e 20 6c 6f 61 64 4c 61 6c 48 65 6c 70 65 72 28 73 61 5f 75 72 6c 2c 65 29 2c 21 30 7d 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 4c 61 6c 48 65 6c 70 65 72 28 65 2c 6f 29 7b 76 61 72 20 74 3d 6e 65 77 20 49 6d 61 67 65 3b 72 65 73 3d 63 75 72 72 65 6e 74 4c 61 6e 64 69 6e 67 55 52 4c 28 29 3b 76 61 Data Ascii: 36ffdy.appendChild(t),current_window_url_param&&current_window_url_param.indexOf(globals.sa_debug_key)>-1&&console.log("SA/RT"))}function loadLal(e){return loadLalHelper(sa_url,e),!0}function loadLalHelper(e,o){var t=new Image;res=currentLandingURL();va
2024-04-26 17:14:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
567	192.168.2.5	50569	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:51 UTC	910	OUT	GET /rp.gif?ts=1714151690433&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:52 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:52 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:52 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
568	192.168.2.5	50570	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:51 UTC	1215	OUT	GET /up_loader.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFGAUgASgDMgsInNfjkeOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE. If-None-Match: "d6f0435164aefe6cf324147b77c7b6bb" If-Modified-Since: Thu, 25 Apr 2024 19:49:47 GMT
2024-04-26 17:14:52 UTC	459	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 25 Apr 2024 19:52:55 GMT Last-Modified: Thu, 25 Apr 2024 19:49:47 GMT ETag: "d6f0435164aefe6cf324147b77c7b6bb" x-amz-server-side-encryption: AES256 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d8457484dcfc33f71f1177376ce3a578.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: EAJi9aZMU4Ag1BnkKSas46plJvvzuxRZTWnd_Enb-f9625UwAahAfw== Age: 76918

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
569	192.168.2.5	50571	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:51 UTC	910	OUT	GET /rp.gif?ts=1714151690436&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:52 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:52 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:52 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
570	192.168.2.5	50572	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:51 UTC	916	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151690571&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&st=1714151690571&et=1714151690571&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; receive-cookie-deprecation=1; uuid2=2808008891046894518
2024-04-26 17:14:52 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:14:52 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:14:52 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
571	192.168.2.5	50574	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	850	OUT	POST /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2F&page_title=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive Content-Length: 63 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151680\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:52 UTC	63	OUT	Data Raw: 7b 22 73 72 63 22 3a 22 74 61 67 22 2c 22 61 75 74 68 22 3a 22 42 47 43 53 44 6b 35 4c 45 48 4f 34 4d 50 56 70 67 44 52 4e 75 50 75 65 33 4d 4a 56 35 47 75 64 4d 31 70 30 45 49 42 6b 22 7d Data Ascii: {"src":"tag","auth":"BGCSDk5LEHO4MPVpgDRNuPue3MJV5GudM1p0EIBk"}
2024-04-26 17:14:52 UTC	951	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Content-Length: 3740 Connection: close Date: Fri, 26 Apr 2024 17:14:52 GMT Server: nginx Access-Control-Allow-Origin: https://www.xero.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: x-amz-cf-id Access-Control-Max-Age: 7200 Access-Control-Allow-Credentials: true Api-Version: v2 Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Identification-Source: CACHE Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 25 Apr 2024 17:14:52 GMT Vary: Accept-Encoding, Origin Request-ID: 5af73fbf-57f9-49d6-ad90-a854e7342c0f X-Cache: Miss from cloudfront Via: 1.1 33193046475e96dea23c35606f55483e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: Krw2qNSrdA1TdKNuNi1kubDLBlv336NhhpViJIjm0ONEUvFeszl4Gg==
2024-04-26 17:14:52 UTC	3740	IN	Data Raw: 7b 22 68 71 22 3a 7b 22 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 64 65 6d 61 6e 64 62 61 73 65 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 61 6c 69 61 73 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 69 6e 64 75 73 74 72 79 22 3a 22 42 75 73 69 6e 65 73 73 20 53 65 72 76 69 63 65 73 22 2c 22 73 75 62 5f 69 6e 64 75 73 74 72 79 22 3a 22 47 65 6e 65 72 61 6c 22 2c 22 65 6d 70 6c 6f 79 65 65 5f 63 6f 75 6e 74 22 3a 32 31 38 34 2c 22 70 72 69 6d 61 72 79 5f 73 69 63 22 3a 22 37 33 38 39 22 2c 22 70 72 69 6d 61 72 79 5f 6e 61 69 63 73 22 3a 6e 75 6c 6c 2c 22 73 74 72 65 65 74 5f 61 64 64 72 65 73 73 22 3a 22 35 39 35 20 53 20 38 30 20 45 20 53 74 65 20 33 30 30 22 2c 22 63 69 74 79 Data Ascii: {"hq":{"company_name":"Conservice","demandbase_sid":27340206,"marketing_alias":"Conservice","industry":"Business Services","sub_industry":"General","employee_count":2184,"primary_sic":"7389","primary_naics":null,"street_address":"595 S 80 E Ste 300","city

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
572	192.168.2.5	50573	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	1355	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:52 UTC	1236	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
573	192.168.2.5	50576	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	1366	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:52 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:52 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
574	192.168.2.5	50577	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	1318	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:52 UTC	1199	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
575	192.168.2.5	50580	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	722	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151690955&i=gtm&dwt=2515&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:52 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:52 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,2a0f094b98d990d300c1e88a869da481,10.0.0.207,43774,102.129.152.220,,232623972613,1,1714151692.529,0.004,,.,0,0,0.000,0.004,-,0,0,203,237,118,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:52 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
576	192.168.2.5	50579	34.96.71.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	782	OUT	GET /s/sync?exc=lr HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151680\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:52 UTC	510	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET,OPTIONS Content-Type: text/html; charset=UTF-8 Set-Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1714151692\|ix:0\|mctv:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Fri, 26 Apr 2024 17:14:52 GMT Content-Length: 74 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:52 UTC	74	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Pixels</title></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
577	192.168.2.5	50581	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	789	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=16958&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 261 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:52 UTC	261	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 5f 74 72 61 63 6b 69 6e 67 22 2c 22 73 74 61 74 75 73 22 3a 32 30 34 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 31 36 32 7d 2c 22 63 62 54 69 6d 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 74 69 6d 65 22 3a 7b 22 74 22 3a 31 34 32 35 Data Ascii: {"xhr":[{"params":{"method":"GET","hostname":"tags.srv.stackadapt.com","port":"443","protocol":"https","host":"tags.srv.stackadapt.com:443","pathname":"/js_tracking","status":204},"metrics":{"count":1,"duration":{"t":162},"cbTime":{"t":0},"time":{"t":1425
2024-04-26 17:14:52 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:52 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760079-MIA
2024-04-26 17:14:52 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
578	192.168.2.5	50575	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	1487	OUT	GET /td/rul/1023673485?random=1714151690667&cv=11&fst=1714151690667&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:52 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:52 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
579	192.168.2.5	50582	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	786	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=16961&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 99 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:52 UTC	99	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 61 7a 78 2c 34 68 2c 2c 2c 27 47 45 54 2c 35 6f 2c 27 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 3a 34 34 33 2c 27 2f 6a 73 5f 74 72 61 63 6b 69 6e 67 2c 2c 2c 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 Data Ascii: bel.7;2,1,azx,4h,,,'GET,5o,'tags.srv.stackadapt.com:443,'/js_tracking,,,,'0,!!!;5,'siteVersion,'new
2024-04-26 17:14:52 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:52 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760071-MIA
2024-04-26 17:14:52 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
580	192.168.2.5	50578	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	1329	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:52 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:52 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
581	192.168.2.5	50584	13.32.87.128	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	635	OUT	GET /bg9s?x-amz-cf-id=Krw2qNSrdA1TdKNuNi1kubDLBlv336NhhpViJIjm0ONEUvFeszl4Gg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	578	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 1d70b90303ff56b86662db87683a2a04.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: GHiTX5N91jovWBs-7puI9sGkkGpyDhjgJr6mtFwuumIOSqWLzs9U1A== Age: 71229 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
582	192.168.2.5	50587	146.75.124.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	625	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "bbbcf811d8437a575d796a4c1e5d4fad" If-Modified-Since: Thu, 04 Apr 2024 00:26:35 GMT
2024-04-26 17:14:52 UTC	339	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:14:52 GMT Cache-Control: no-cache ETag: "bbbcf811d8437a575d796a4c1e5d4fad" X-Served-By: cache-mia-kmia1760076-MIA X-Cache: HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
583	192.168.2.5	50585	15.197.193.217	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	1375	OUT	GET /track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/ HTTP/1.1 Host: insight.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFGAUgASgDMgsInNfjkeOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.
2024-04-26 17:14:53 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:52 GMT Content-Type: text/html Content-Length: 868 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:52 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFGAUoAzILCPbO8uTjh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB; expires=Sat, 26 Apr 2025 17:14:52 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:53 UTC	868	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 61 64 73 72 76 72 2e 6f 72 67 2f 75 6e 69 76 65 72 73 61 6c 5f 70 69 78 65 6c 2e 31 2e 31 2e 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 75 6e 69 76 65 72 73 61 6c 50 69 78 65 6c 43 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 6c 6f 62 61 6c 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <html><head> <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script></head><body> <div id="universalPixelContainer"> <script type="text/javascript"> (function(global) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
584	192.168.2.5	50590	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	3240	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=A_Q7s4unGTnYm-YPVctf24Pt9G8KKVg5hW4EYiIohJM&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a929394959697989 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:53 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:53 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
585	192.168.2.5	50591	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	3196	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=A_Q7s4unGTnYm-YPVctf24Pt9G8KKVg5hW4EYiIohJM&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:53 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:53 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
586	192.168.2.5	50600	13.35.116.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	591	OUT	GET /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2F&page_title=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151692\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:53 UTC	491	IN	HTTP/1.1 401 Unauthorized Content-Type: text/plain;charset=utf-8 Content-Length: 12 Connection: close Date: Fri, 26 Apr 2024 17:14:53 GMT Server: nginx WWW-Authenticate: DemandBase API v2 X-Content-Type-Options: nosniff Request-ID: 75d08f46-b28f-4b45-8008-3b4b9aa1c111 Vary: Origin X-Cache: Error from cloudfront Via: 1.1 aee6619aa3e21e3827aea4ae78caedb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: X4whem-WVNyhJaY1_YHVz-BZn5XQPyQ-toUZaFRToo93wnvRNX-NPQ==
2024-04-26 17:14:53 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
587	192.168.2.5	50601	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	678	OUT	GET /rp.gif?ts=1714151690433&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:53 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
588	192.168.2.5	50603	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:52 UTC	678	OUT	GET /rp.gif?ts=1714151690436&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:53 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
589	192.168.2.5	50596	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	487	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688247&i=gtm&dwt=1&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:53 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,9f535ec2b00450a2e0985dc1f9ef2a29,10.0.0.207,43930,102.129.152.220,,8589416221,1,1714151693.280,0.004,,.,0,0,0.000,0.004,-,0,0,203,125,62,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
590	192.168.2.5	50595	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	487	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688252&i=gtm&dwt=5&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:53 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,70d52d824681eb83b4cef7411b1efd9e,10.0.0.207,48332,102.129.152.220,,232623977172,1,1714151693.279,0.002,,.,0,0,0.000,0.004,-,0,0,203,213,106,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
591	192.168.2.5	50598	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	495	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151688257&i=gtm&dwt=1&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:53 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,1be7567f37a8ee9f4a32103eb92bb9f5,10.0.0.207,62430,102.129.152.220,,232877323272,1,1714151693.278,0.002,,.,0,0,0.000,0.000,-,0,0,203,138,69,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
592	192.168.2.5	50594	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151687243 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:53 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: S9bhyUwaShE= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-0247ae2a3.edge-va6.demdex.com 9 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:53 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:53 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
593	192.168.2.5	50604	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	490	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151690955&i=gtm&dwt=2515&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:53 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,1ce45017aaebdbb7f7fa13d7a35c2372,10.0.0.207,47992,102.129.152.220,,361522323227,1,1714151693.298,0.002,,.,0,0,0.000,0.000,-,0,0,203,128,64,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
594	192.168.2.5	50599	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	532	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151690571&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&st=1714151690571&et=1714151690571&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=2808008891046894518
2024-04-26 17:14:53 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:14:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
595	192.168.2.5	50589	67.220.226.233	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	652	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151691548 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:14:53 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: WE3410Z6G0EF51WC5E2T Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:14:53 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:14:53 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:14:53 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
596	192.168.2.5	50607	13.32.87.74	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	437	OUT	GET /bg9s?x-amz-cf-id=Krw2qNSrdA1TdKNuNi1kubDLBlv336NhhpViJIjm0ONEUvFeszl4Gg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	560	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 3f72a8b28c744ea2f627e9f8a8ac8282.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: EyKKLZcmsrk-nW5MTtnCLCo453ORSHEDhHf6aiN-NOI_tfKdegw3Kg== Age: 71230 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
597	192.168.2.5	50606	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	1352	OUT	GET /activityi;dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:53 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:53 GMT Expires: Fri, 26 Apr 2024 17:14:53 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:53 UTC	592	IN	Data Raw: 32 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4f 50 6d 35 39 57 77 34 49 55 44 46 5a Data Ascii: 2b3<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COPm59Ww4IUDFZ
2024-04-26 17:14:53 UTC	106	IN	Data Raw: 3b 6d 61 74 63 68 5f 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>
2024-04-26 17:14:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
598	192.168.2.5	50608	3.234.43.148	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	855	OUT	GET /bct?pid=211f5e71-10d4-4933-8c11-c9798f096adc&_ct=img&puid=e09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: mid.rkdms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc=12%3A116736; sessionid=h-8bf082a70be845d5b8394e1975e85604_t-1714151685
2024-04-26 17:14:53 UTC	627	IN	HTTP/1.1 302 FOUND Server: awselb/2.0 Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close set-cookie: sc=11%3A116736; Domain=rkdms.com; Expires=Sat, 26 Apr 2025 17:14:53 GMT; Secure; Path=/; SameSite=None set-cookie: sessionid=h-8bf082a70be845d5b8394e1975e85604_t-1714151685; Domain=rkdms.com; Expires=Sat, 26 Apr 2025 17:14:53 GMT; Secure; Path=/; SameSite=None Vary: Accept-Encoding Pragma: no-cache Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=4h3yn1f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
599	192.168.2.5	50610	52.223.22.214	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	831	OUT	GET /xuid?mid=3658&xuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&dongle=0cfd&gdpr=0&gdpr_consent=&redir=https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50 HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	701	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Length: 0 Connection: close Location: /xuid?ld=1&mid=3658&xuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&dongle=0cfd&gdpr=0&cmp_cs=&us_privacy= Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=4582323497069516410268; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Thu, 25 Jul 2024 17:14:53 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=4582323497069516410268; Max-Age=7776000; Expires=Thu, 25 Jul 2024 17:14:53 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
600	192.168.2.5	50609	34.117.77.79	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	843	OUT	GET /utsync.ashx?eid=53819&et=0&fp=e09cd2aa-7185-40a5-bf74-4fc29b294347&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dd0tro1j HTTP/1.1 Host: ml314.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	669	IN	HTTP/1.1 302 Found content-type: image/gif cache-control: no-cache, no-store, must-revalidate expires: 0,Sat, 27 Apr 2024 17:14:53 GMT location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j pragma: no-cache set-cookie: pi=3643738932024705066; expires=Sat, 26 Apr 2025 17:14:53 GMT; domain=ml314.com; path=/; secure; samesite=none; httponly p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA" x-cloud-trace-context: 85a62b70a4768e451893d4c843ab5c4a date: Fri, 26 Apr 2024 17:14:53 GMT server: Google Frontend Content-Length: 43 via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
601	192.168.2.5	50612	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	669	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:53 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:53 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,d7ae1fdf09c4beb62007a048e7a546bc,10.0.0.207,45364,102.129.152.220,,8589418342,1,1714151693.811,0.002,,.,0,0,0.000,0.000,-,0,0,203,137,68,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
602	192.168.2.5	50616	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	2998	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=A_Q7s4unGTnYm-YPVctf24Pt9G8KKVg5hW4EYiIohJM&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:53 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:14:53 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
603	192.168.2.5	50617	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	3042	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2F&t=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&tip=A_Q7s4unGTnYm-YPVctf24Pt9G8KKVg5hW4EYiIohJM&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a929394959697989 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:53 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:14:53 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
604	192.168.2.5	50614	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	1337	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source;navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:54 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:53 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"7281796565064678753","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_typ [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
605	192.168.2.5	50613	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	1282	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:54 UTC	2232	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:53 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"6069486696280244416","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"sou [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
606	192.168.2.5	50592	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	1389	OUT	GET /activityi;dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:54 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:53 GMT Expires: Fri, 26 Apr 2024 17:14:53 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:54 UTC	592	IN	Data Raw: 32 64 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4f 5f 54 39 74 57 77 34 49 55 44 46 59 Data Ascii: 2d8<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CO_T9tWw4IUDFY
2024-04-26 17:14:54 UTC	143	IN	Data Raw: 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 70 73 63 64 6c 3d 6e 6f 61 70 69 3b 67 74 6d 3d 34 35 66 65 34 34 6f 30 7a 38 38 33 30 39 32 33 34 37 30 7a 61 32 30 31 3b 67 63 64 3d 31 33 6c 33 6c 33 6c 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: =10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F"/></body></html>
2024-04-26 17:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
607	192.168.2.5	50615	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:53 UTC	915	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A50%20GMT&n=-2d&b=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:14:53 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:53 GMT Expires: Fri, 26 Apr 2024 17:14:53 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:14:53 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:14:53 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
608	192.168.2.5	50621	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	852	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690812&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=1, ullat=1 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
609	192.168.2.5	50623	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	711	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151691548 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Attribution-Reporting-Eligible: not-navigation-source, trigger;event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:14:54 GMT x-amzn-RequestId: 88399ea9-7b8d-40a6-9c11-ee0f90fbc872 Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Access-Control-Allow-Credentials: true X-Cache: Miss from cloudfront Via: 1.1 a61500b02203448696480e37b5438a58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: nFVwUVm3_kaHfxhMN4FmuPuPJal3fgsvaTmUkIwCCUVGrJfp0JbhVQ==
2024-04-26 17:14:54 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
610	192.168.2.5	50620	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	1381	OUT	GET /pixel;r=1754710088;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151690786;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Beautiful%20Business%20%26%20Accounting%20Software%2Cdescription.Xero%20online%20accounting%20software%20for%20your%20business%20connects%20you%20to%20your%20bank%252C%20acc%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=570bdd9f-c7ca-4bc8-8c62-63709693a0d0;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:14:54 UTC	282	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:54 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:14:54 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
611	192.168.2.5	50619	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	673	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=p2jiJ1gSgsCwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:14:54 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=EQ3/YLaZzBqwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:14:54 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:14:54 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:14:54 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
612	192.168.2.5	50625	52.223.22.214	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	846	OUT	GET /xuid?ld=1&mid=3658&xuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&dongle=0cfd&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluidp=4582323497069516410268; tluid=4582323497069516410268
2024-04-26 17:14:54 UTC	612	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:54 GMT Content-Type: image/gif Content-Length: 37 Connection: close Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=4582323497069516410268; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Thu, 25 Jul 2024 17:14:54 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=4582323497069516410268; Max-Age=7776000; Expires=Thu, 25 Jul 2024 17:14:54 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None
2024-04-26 17:14:54 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
613	192.168.2.5	50624	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	1143	OUT	GET /ddm/fls/z/dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
614	192.168.2.5	50618	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	1393	OUT	GET /track/cmf/generic?ttd_pid=4h3yn1f HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFGAUoAzILCPbO8uTjh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:14:54 UTC	1016	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:54 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:54 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFGAUgASgDMgsI9s7y5OOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:14:54 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:54 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
615	192.168.2.5	50629	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	962	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690812&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger;navigation-source, event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:54 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:54 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:14:54 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
616	192.168.2.5	50622	52.94.222.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	481	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151691548 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:14:54 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:14:54 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: TJ54ZRKPQM80GR6W91WW Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:14:54 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:14:54 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:14:54 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
617	192.168.2.5	50628	142.250.189.132	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	661	OUT	GET /recaptcha/api.js?onload=onloadcallback&render=explicit HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Fri, 26 Apr 2024 17:14:54 GMT Date: Fri, 26 Apr 2024 17:14:54 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:54 UTC	727	IN	Data Raw: 35 30 31 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 501/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-26 17:14:54 UTC	561	IN	Data Raw: 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f Data Ascii: SI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js';po.cro
2024-04-26 17:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
618	192.168.2.5	50635	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	881	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690816&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
619	192.168.2.5	50632	63.140.39.93	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	734	OUT	POST /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive Content-Length: 367 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" pragma: no-cache sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain accept: / cache-control: no-cache sec-ch-ua-platform: "Windows" Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	367	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 68 61 6e 6e 65 6c 22 3a 22 77 65 62 22 2c 22 61 64 64 72 65 73 73 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 73 69 67 6e 75 70 2f 22 2c 22 72 65 66 65 72 72 69 6e 67 55 72 6c 22 3a 22 22 7d 7d 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 78 70 65 72 69 65 6e 63 65 43 6c 6f 75 64 22 3a 7b 22 61 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 Data Ascii: {"context":{"channel":"web","address":{"url":"https://www.xero.com/us/signup/","referringUrl":""}},"id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"experienceCloud":{"audienceManager
2024-04-26 17:14:54 UTC	838	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:54 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://www.xero.com access-control-allow-credentials: true x-request-id: 6b249e85-29cd-4ea6-b37d-157a08bd63e3 timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:54 UTC	355	IN	Data Raw: 31 35 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 37 31 31 38 65 31 63 37 2d 63 62 37 39 2d 34 64 30 31 2d 62 32 31 35 2d 63 63 62 61 36 62 38 34 37 62 34 35 22 2c 22 63 6c 69 65 6e 74 22 3a 22 78 65 72 6f 6c 69 6d 69 74 65 64 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 2e 33 34 5f 30 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 34 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 Data Ascii: 15c{"status":200,"requestId":"7118e1c7-cb79-4d01-b215-ccba6b847b45","client":"xerolimited","id":{"tntId":"162dff65-da12-4bc6-ad62-6b12d5f14651.34_0","marketingCloudVisitorId":"03549638624246876723885913874856506827"},"edgeHost":"mboxedge34.tt.omtrdc.net
2024-04-26 17:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
620	192.168.2.5	50626	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	1393	OUT	GET /track/cmf/generic?ttd_pid=d0tro1j HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFGAUoAzILCPbO8uTjh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:14:54 UTC	1016	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:54 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:14:54 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFGAUgASgDMgsI9s7y5OOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.; expires=Sat, 26 Apr 2025 17:14:54 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:14:54 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
621	192.168.2.5	50627	142.250.189.132	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	678	OUT	GET /recaptcha/enterprise.js?render=6Le6fDsoAAAAABLpuIc7lmLNZEa2f-gLLKbb4bnV HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Fri, 26 Apr 2024 17:14:54 GMT Date: Fri, 26 Apr 2024 17:14:54 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:54 UTC	727	IN	Data Raw: 35 37 64 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 45 3d 27 65 6e 74 65 72 70 72 69 73 65 27 2c 61 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 2c 67 72 3d 61 5b 45 5d 3d 61 5b 45 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f Data Ascii: 57d/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var E='enterprise',a=w[N]=w[N]\|\|{},gr=a[E]=a[E]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['_
2024-04-26 17:14:54 UTC	685	IN	Data Raw: 6d 43 41 4c 53 45 55 32 39 79 51 46 57 38 64 65 50 5a 37 78 51 54 76 53 74 37 33 70 48 61 7a 4c 46 54 4b 35 66 37 53 79 4c 55 4a 53 6f 32 75 4b 4c 65 73 45 74 45 61 39 61 55 59 63 67 4d 41 41 41 43 50 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 Data Ascii: mCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1
2024-04-26 17:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
622	192.168.2.5	50640	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	991	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690816&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger=navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:54 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:54 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:54 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:14:54 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
623	192.168.2.5	50633	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151693063 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 387 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:54 UTC	387	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 39 33 30 36 33 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 68 61 73 68 3d 26 63 5f 68 6f 73 74 3d 77 77 77 2e 78 65 72 6f 2e 63 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151693063&d_rtbd=json&d_jsonv=1&d_dst=1&c_hash=&c_host=www.xero.co
2024-04-26 17:14:54 UTC	987	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:54 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: 2QJmeRplQME= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-1-v056-07cfc102b.edge-usw2.demdex.com 5 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:54 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:54 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:54 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 32 51 4a 6d 65 52 70 6c 51 4d 45 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"2QJmeRplQME="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
624	192.168.2.5	50642	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	772	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=3966&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 428 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:54 UTC	428	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 32 79 2c 31 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 65 2c 27 66 63 70 2c 32 79 2c 31 3b 35 2c 31 2c 32 3b 65 2c 27 6c 6f 61 64 2c 31 6e 37 2c 32 3b 36 2c 27 63 6c 73 2c 30 2e 31 30 30 37 30 32 36 39 32 30 30 33 31 36 37 30 36 3b 35 2c 31 2c 32 3b 65 2c 27 6c 63 70 2c 31 62 30 2c 39 3b 36 2c 27 73 69 7a 65 2c 34 30 32 32 38 37 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 65 6c 55 72 6c 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 64 61 6d 2f 78 65 72 6f 2f 70 69 6c 6f 74 2d 69 6d 61 67 65 73 2f 65 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 2f 32 30 32 34 2d 71 34 2d 61 77 61 72 64 73 2d 62 61 64 67 65 73 2d 66 6f 72 2d 68 65 61 64 65 72 73 2f 55 53 5f 25 32 30 Data Ascii: bel.6;e,'fp,2y,1;5,'siteVersion,'new;e,'fcp,2y,1;5,1,2;e,'load,1n7,2;6,'cls,0.10070269200316706;5,1,2;e,'lcp,1b0,9;6,'size,402287.;5,'eid;5,'elUrl,'https://www.xero.com/content/dam/xero/pilot-images/experimentation/2024-q4-awards-badges-for-headers/US_%20
2024-04-26 17:14:54 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:54 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760090-MIA
2024-04-26 17:14:54 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
625	192.168.2.5	50643	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:54 UTC	775	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=3967&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1029 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:54 UTC	1029	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 56 65 72 73 69 6f 6e 2f 31 2e 32 33 36 2e 30 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 4c 6f 61 64 65 72 54 79 70 65 2f 73 70 61 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 43 44 4e 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 Data Ascii: {"sm":[{"params":{"name":"Generic/Version/1.236.0/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/LoaderType/spa/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/DistMethod/CDN/Detected"},"stats":{"c":1}},{"params":{"name":"API/setCustomAttri
2024-04-26 17:14:54 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:54 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760081-MIA
2024-04-26 17:14:54 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
626	192.168.2.5	50646	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	437	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:56 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:56 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,3080515ae94ccf698139ed88ed0a42f6,10.0.0.207,12298,102.129.152.220,,232623994050,1,1714151696.023,0.005,,.,0,0,0.004,0.008,-,0,0,203,159,79,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
627	192.168.2.5	50645	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	683	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A50%20GMT&n=-2d&b=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:14:56 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:50 GMT Expires: Fri, 26 Apr 2024 17:15:50 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:15:50 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
628	192.168.2.5	50649	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 135 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:55 UTC	135	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 36 30 36 39 34 38 36 36 39 36 32 38 30 32 34 34 34 31 36 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"6069486696280244416"},"type":"trigger-no-matching-source"}]
2024-04-26 17:14:56 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:14:56 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
629	192.168.2.5	50652	104.244.42.133	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	965	OUT	GET /i/adsct?bci=3&eci=2&event_id=f417ff46-17db-4305-a677-99e80a171a65&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=f1391b57-628e-45ec-b2c0-46d9264495db&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:14:56 UTC	392	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:56 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 638f13049f966c26 strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: 9b0f2899e4ac52a3874c4b835ebfae47bba18fa85dba6cde72af7ebc01c18738 connection: close
2024-04-26 17:14:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
630	192.168.2.5	50647	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	1032	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:56 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:56 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"7281796565064678753","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_typ [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:56 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
631	192.168.2.5	50648	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	995	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:56 UTC	2232	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:56 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"6069486696280244416","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"sou [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:14:56 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
632	192.168.2.5	50641	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	1180	OUT	GET /ddm/fls/z/dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:56 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:56 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
633	192.168.2.5	50650	172.217.3.70	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:55 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 135 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:55 UTC	135	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 37 32 38 31 37 39 36 35 36 35 30 36 34 36 37 38 37 35 33 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"7281796565064678753"},"type":"trigger-no-matching-source"}]
2024-04-26 17:14:56 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:14:56 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
634	192.168.2.5	50653	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	775	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=3967&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 2645 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:56 UTC	2645	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 22 2c 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 32 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 32 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 39 37 33 2c 22 6d 69 6e 22 3a 34 37 32 2c 22 6d 61 78 22 3a 35 30 31 2c 22 73 6f 73 22 3a 34 37 33 37 38 35 2c 22 63 22 3a 32 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/api/events/v1/","method":"POST","status":202},"metrics":{"count":2,"txSize":{"t":973,"min":472,"max":501,"sos":473785,"c":2},"rxSize":{"t":
2024-04-26 17:14:56 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:56 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760055-MIA
2024-04-26 17:14:56 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
635	192.168.2.5	50654	52.40.174.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	745	OUT	POST /event?d_dil_ver=9.4&_ts=1714151693199 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive Content-Length: 248 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:56 UTC	248	OUT	Data Raw: 64 5f 6d 69 64 3d 30 33 35 34 39 36 33 38 36 32 34 32 34 36 38 37 36 37 32 33 38 38 35 39 31 33 38 37 34 38 35 36 35 30 36 38 32 37 26 64 5f 6e 73 69 64 3d 30 26 64 5f 64 70 69 64 3d 31 33 38 38 39 39 26 64 5f 64 70 75 75 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 26 64 5f 63 69 64 5f 69 63 3d 78 65 72 6f 5f 69 64 25 30 31 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 25 30 31 32 26 64 5f 6c 64 3d 5f 74 73 25 33 44 31 37 31 34 31 35 31 36 39 33 31 39 39 26 64 5f 72 74 62 64 3d 6a 73 6f 6e 26 64 5f 6a 73 6f 6e 76 3d 31 26 64 5f 64 73 74 3d 31 26 63 5f 72 65 66 65 72 72 65 72 3d 6e 6f 74 2d 78 65 72 6f Data Ascii: d_mid=03549638624246876723885913874856506827&d_nsid=0&d_dpid=138899&d_dpuuid=162dff65-da12-4bc6-ad62-6b12d5f14651&d_cid_ic=xero_id%01162dff65-da12-4bc6-ad62-6b12d5f14651%012&d_ld=_ts%3D1714151693199&d_rtbd=json&d_jsonv=1&d_dst=1&c_referrer=not-xero
2024-04-26 17:14:56 UTC	988	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:56 GMT Content-Type: application/json;charset=utf-8 Content-Length: 241 Connection: close X-TID: 4FP8QOZ5RPQ= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-usw2-2-v056-0ae9b3aab.edge-usw2.demdex.com 27 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:56 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:56 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:56 UTC	241	IN	Data Raw: 7b 22 73 74 75 66 66 22 3a 5b 7b 22 63 6e 22 3a 22 61 61 6d 5f 70 69 6c 6f 74 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 31 35 33 33 32 30 35 2c 73 65 67 3d 32 31 35 33 33 32 33 31 2c 3d 32 31 36 38 39 31 38 38 2c 3d 32 34 37 36 37 33 32 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 2c 7b 22 63 6e 22 3a 22 61 61 6d 5f 78 65 72 6f 22 2c 22 63 76 22 3a 22 73 65 67 3d 32 32 32 38 33 32 36 39 22 2c 22 74 74 6c 22 3a 33 30 2c 22 64 6d 6e 22 3a 22 22 7d 5d 2c 22 75 75 69 64 22 3a 22 30 33 35 32 30 30 30 36 36 30 34 30 33 32 37 36 35 35 38 33 38 38 32 36 38 34 39 36 39 30 32 34 34 36 35 36 36 31 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 74 69 64 22 3a 22 34 46 50 38 51 4f 5a 35 52 50 51 3d 22 7d Data Ascii: {"stuff":[{"cn":"aam_pilot","cv":"seg=21533205,seg=21533231,=21689188,=24767329","ttl":30,"dmn":""},{"cn":"aam_xero","cv":"seg=22283269","ttl":30,"dmn":""}],"uuid":"03520006604032765583882684969024465661","dcs_region":9,"tid":"4FP8QOZ5RPQ="}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
636	192.168.2.5	50655	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	620	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690812&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:56 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:56 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
637	192.168.2.5	50658	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	705	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151693461&i=gtm&dwt=163&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:56 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:56 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,d8bd02c0d7d905485f6c717aa27db8c2,10.0.0.207,15634,102.129.152.220,,232623997777,1,1714151696.762,0.002,,.,0,0,0.000,0.000,-,0,0,203,210,105,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
638	192.168.2.5	50656	104.244.42.195	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	986	OUT	GET /i/adsct?bci=3&eci=2&event_id=f417ff46-17db-4305-a677-99e80a171a65&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=f1391b57-628e-45ec-b2c0-46d9264495db&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:14:56 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:55 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 22524c870b503b51 strict-transport-security: max-age=631138519 x-response-time: 73 x-connection-hash: e0c19712775ac51ca0f7a419221bfa44429cb039c5739b2094ee58e09090ebd7 connection: close
2024-04-26 17:14:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
639	192.168.2.5	50657	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	711	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151693465&i=gtm&dwt=3&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:56 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:56 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,0b903902b5c385bba10023a17825f5ba,10.0.0.207,50774,102.129.152.220,,8589423791,1,1714151696.762,0.001,,.,0,0,0.000,0.000,-,0,0,203,146,73,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
640	192.168.2.5	50659	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	772	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=3968&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 720 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:56 UTC	720	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 31 79 6b 2c 61 73 2c 2c 2c 27 50 4f 53 54 2c 35 6d 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 2c 64 34 2c 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 31 79 6d 2c 66 71 2c 2c 2c 30 2c 35 6d 2c 31 2c 32 2c 64 78 2c 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 32 35 35 2c 39 38 2c 2c 2c 27 47 45 54 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 32 35 36 2c 39 38 2c 2c 2c 36 2c 35 6b 2c 31 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 Data Ascii: bel.7;2,1,1yk,as,,,'POST,5m,'www.xero.com:443,'/api/events/v1/,d4,,1,'0,!!!;5,'siteVersion,'new;2,1,1ym,fq,,,0,5m,1,2,dx,,1,3,!!!;5,4,5;2,1,255,98,,,'GET,5k,1,'/_next/data/1712725399/us.json,,nwx,1,3,!!!;5,4,5;2,1,256,98,,,6,5k,1,'/_next/data/1712725399/u
2024-04-26 17:14:56 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:56 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760062-MIA
2024-04-26 17:14:56 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
641	192.168.2.5	50664	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	774	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=4192&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 323 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:56 UTC	323	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 75 73 65 72 2d 74 72 61 63 6b 69 6e 67 2d 61 70 69 2e 64 67 74 2d 64 69 67 69 74 61 6c 2d 6d 61 72 6b 65 74 69 6e 67 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 75 73 65 72 2d 74 72 61 63 6b 69 6e 67 2d 61 70 69 2e 64 67 74 2d 64 69 67 69 74 61 6c 2d 6d 61 72 6b 65 74 69 6e 67 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 71 75 65 72 79 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b Data Ascii: {"xhr":[{"params":{"hostname":"user-tracking-api.dgt-digital-marketing.xero.com","port":"443","protocol":"https","host":"user-tracking-api.dgt-digital-marketing.xero.com:443","pathname":"/query","method":"GET","status":200},"metrics":{"count":1,"txSize":{
2024-04-26 17:14:56 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:56 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760020-MIA
2024-04-26 17:14:56 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
642	192.168.2.5	50663	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	775	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=7756&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 2345 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:56 UTC	2345	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 22 2c 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 32 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 34 35 35 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 32 31 37 38 7d 2c 22 74 69 6d 65 22 3a 7b 22 74 22 3a 34 31 Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/api/events/v1/","method":"POST","status":202},"metrics":{"count":1,"txSize":{"t":455},"rxSize":{"t":0},"duration":{"t":2178},"time":{"t":41
2024-04-26 17:14:56 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:56 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760074-MIA
2024-04-26 17:14:56 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
643	192.168.2.5	50666	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:56 UTC	775	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=9462&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1735 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:14:56 UTC	1735	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 74 61 67 2d 6c 6f 67 67 65 72 2e 64 65 6d 61 6e 64 62 61 73 65 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 74 61 67 2d 6c 6f 67 67 65 72 2e 64 65 6d 61 6e 64 62 61 73 65 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 62 67 39 73 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 36 34 33 7d 2c 22 63 62 54 69 6d 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 74 69 6d 65 22 3a 7b 22 74 22 3a 37 33 39 38 7d 7d 7d Data Ascii: {"xhr":[{"params":{"method":"GET","hostname":"tag-logger.demandbase.com","port":"443","protocol":"https","host":"tag-logger.demandbase.com:443","pathname":"/bg9s","status":200},"metrics":{"count":1,"duration":{"t":643},"cbTime":{"t":0},"time":{"t":7398}}}
2024-04-26 17:14:57 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:14:57 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760026-MIA
2024-04-26 17:14:57 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
644	192.168.2.5	50669	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	436	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151691548 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	378	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:14:57 GMT x-amzn-RequestId: 52a7bacf-a09d-4557-9682-46085a6f4f28 X-Cache: Miss from cloudfront Via: 1.1 abdbda373f0ee600e1b9e86e5aa747a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: 3VqRGXja9oJeqBiAABy7NDidiqoun9xcUaVuVPC3xQbqLQuFN24iSw==
2024-04-26 17:14:57 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
645	192.168.2.5	50675	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	686	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690816&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:57 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:57 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
646	192.168.2.5	50677	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	657	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690812&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:14:57 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:14:57 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
647	192.168.2.5	50673	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	649	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2F&rl=&if=false&ts=1714151690816&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151690574&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=126, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=1, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:14:57 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
648	192.168.2.5	50668	142.250.189.132	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	1687	OUT	GET /pagead/1p-conversion/1023673485/?random=1728995835&cv=11&fst=1714151690667&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSidldmVudC1zb3VyY2UsIHRyaWdnZXI7bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=COG65r3EhL3bJCITCPPiutaw4IUDFQStgwgdN5oGtjICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLOhVodHRwczovL3d3dy54ZXJvLmNvbS8&is_vtc=1&cid=CAQSKQB7FLtqd8gBf05OTZTamWKGBhbffL8fi_fHGTSPLLWxanOxFUl7JzHp&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaJ5RFsst6Nr7x2IFFvfMmIR0ukeYigPN4w&random=294050109 [TRUNCATED] Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
649	192.168.2.5	50670	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	1149	OUT	GET /pixel;r=1754710088;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151690786;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Beautiful%20Business%20%26%20Accounting%20Software%2Cdescription.Xero%20online%20accounting%20software%20for%20your%20business%20connects%20you%20to%20your%20bank%252C%20acc%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=570bdd9f-c7ca-4bc8-8c62-63709693a0d0;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:14:57 UTC	354	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:57 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:14:57 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
650	192.168.2.5	50679	104.244.42.69	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	733	OUT	GET /i/adsct?bci=3&eci=2&event_id=f417ff46-17db-4305-a677-99e80a171a65&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=f1391b57-628e-45ec-b2c0-46d9264495db&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:14:57 UTC	393	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:57 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 56f1970b09abe54d strict-transport-security: max-age=0 x-response-time: 88 x-connection-hash: f41a8ba7c32afa4d7115041061e183a9a4c55c1c369057b7fd11200d5b90f29e connection: close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
651	192.168.2.5	50671	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	441	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=EQ3/YLaZzBqwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:14:57 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=xcnk+eZDxpmwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:14:57 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:14:57 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:14:57 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
652	192.168.2.5	50674	63.140.39.93	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	445	OUT	GET /rest/v1/delivery?client=xerolimited&version=2.3.1&sessionId=092b0c9a-08a6-42f2-9740-e1640892e4ce HTTP/1.1 Host: xerolimited.tt.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Fri, 26 Apr 2024 17:14:57 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-26 17:14:57 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-26 17:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
653	192.168.2.5	50676	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151693063 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:57 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:57 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: YBdEN0pST7k= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v059-0ae7b9169.edge-va6.demdex.com 6 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:57 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:57 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
654	192.168.2.5	50681	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	896	OUT	GET /ddm/fls/z/dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
655	192.168.2.5	50672	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	933	OUT	GET /ddm/fls/z/dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
656	192.168.2.5	50685	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	706	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695742&i=gtm&dwt=2277&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,f8d251dc582470d1a13608f1f4bb452f,10.0.0.207,53350,102.129.152.220,,361522346958,1,1714151697.472,0.004,,.,0,0,0.000,0.004,-,0,0,203,235,117,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
657	192.168.2.5	50683	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	703	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695744&i=gtm&dwt=1&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,fecbbdc50412c65d47bf04c227d22882,10.0.0.207,53310,102.129.152.220,,361522346927,1,1714151697.476,0.007,,.,0,0,0.000,0.008,-,0,0,203,146,73,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
658	192.168.2.5	50684	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	711	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695748&i=gtm&dwt=1&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,4186965cfc48dbb16dff4c896d5ed6e4,10.0.0.207,53964,102.129.152.220,,8589427412,1,1714151697.470,0.002,,.,0,0,0.004,0.004,-,0,0,203,149,74,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
659	192.168.2.5	50687	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	712	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695923&i=gtm&dwt=10&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,1a7e638aa9390c8c7f568c5fb0cc3e97,10.0.0.207,54136,102.129.152.220,,8589427677,1,1714151697.514,0.002,,.,0,0,0.000,0.000,-,0,0,203,136,68,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
660	192.168.2.5	50688	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	704	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695964&i=gtm&dwt=35&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,7213280fe254a18c56ff8f26b9fd9b55,10.0.0.207,53598,102.129.152.220,,361522347249,1,1714151697.538,0.002,,.,0,0,0.000,0.000,-,0,0,203,121,60,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
661	192.168.2.5	50667	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: r8XpLXMATta0YZ7N1ko9xw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:14:57 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:14:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:14:57 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
662	192.168.2.5	50694	104.244.42.67	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	754	OUT	GET /i/adsct?bci=3&eci=2&event_id=f417ff46-17db-4305-a677-99e80a171a65&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=f1391b57-628e-45ec-b2c0-46d9264495db&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:14:57 UTC	400	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:14:57 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: d456fa5889133de5 strict-transport-security: max-age=631138519 x-response-time: 6 x-connection-hash: 5a9e40c4f9dc4e5a9cb3c3fe883980002f63afd416f807fdfb79d4cabb4f5ca6 connection: close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
663	192.168.2.5	50691	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	705	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696133&i=gtm&dwt=154&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,0e79ee81c4e800eed091e30f9be55cae,10.0.0.207,20108,102.129.152.220,,232624002942,1,1714151697.761,0.002,,.,0,0,0.000,0.000,-,0,0,203,245,122,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
664	192.168.2.5	50692	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	473	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151693461&i=gtm&dwt=163&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,c63db30bc6392d5da0b3cc512fbee132,10.0.0.207,54534,102.129.152.220,,361522348552,1,1714151697.780,0.004,,.,0,0,0.000,0.004,-,0,0,203,152,76,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
665	192.168.2.5	50693	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	479	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151693465&i=gtm&dwt=3&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:57 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:57 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,bb37de3d57f77755f8369289c01a7e81,10.0.0.207,34328,102.129.152.220,,232877349604,1,1714151697.789,0.004,,.,0,0,0.000,0.004,-,0,0,203,132,66,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
666	192.168.2.5	50695	44.193.186.241	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	476	OUT	GET /event?d_dil_ver=9.4&_ts=1714151693199 HTTP/1.1 Host: xero.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=03520006604032765583882684969024465661; xero=03520006604032765583882684969024465661
2024-04-26 17:14:57 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:57 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: IS+icTPyR28= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v059-007a11edb.edge-va6.demdex.com 7 ms set-cookie: demdex=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:57 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None set-cookie: xero=03520006604032765583882684969024465661; Max-Age=15552000; Expires=Wed, 23 Oct 2024 17:14:57 GMT; Path=/; Domain=.xero.demdex.net; Secure; SameSite=None
2024-04-26 17:14:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
667	192.168.2.5	50701	18.64.168.121	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	1311	OUT	GET /up_loader.1.1.0.js HTTP/1.1 Host: js.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFGAUgASgDMgsI9s7y5OOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE. If-None-Match: "d6f0435164aefe6cf324147b77c7b6bb" If-Modified-Since: Thu, 25 Apr 2024 19:49:47 GMT
2024-04-26 17:14:58 UTC	459	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 25 Apr 2024 19:52:55 GMT Last-Modified: Thu, 25 Apr 2024 19:49:47 GMT ETag: "d6f0435164aefe6cf324147b77c7b6bb" x-amz-server-side-encryption: AES256 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 af68fd87ee6cdda16f897e9bf046dd8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: 32JJYuRu1bIx4KmdMIxLQ--Fs9c3voJF7syPdDWz7UbPjhYNyI1riQ== Age: 76924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
668	192.168.2.5	50699	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	705	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696375&i=gtm&dwt=119&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,8d75e393f47cf9b3f44599341e0d2b0e,10.0.0.207,22596,102.129.152.220,,232624005436,1,1714151698.174,0.003,,.,0,0,0.000,0.000,-,0,0,203,217,108,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
669	192.168.2.5	50700	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	1220	OUT	GET /events.js HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:58 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:58 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=5
2024-04-26 17:14:58 UTC	16192	IN	Data Raw: 34 36 34 36 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 77 29 20 7b 0a 20 20 2f 2f 20 42 65 67 69 6e 20 64 6f 63 0a 0a 20 20 76 61 72 20 69 73 5f 64 65 76 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 66 61 6c 73 65 20 29 20 7b 0a 20 20 20 20 69 73 5f 64 65 76 20 3d 20 74 72 75 65 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 69 66 20 28 20 74 72 75 65 20 29 20 7b 0a 20 20 20 20 64 69 73 61 62 6c 65 5f 73 79 6e 63 20 3d 20 74 72 75 65 0a 20 20 7d 0a 0a 20 20 76 61 72 20 74 69 70 20 3d 20 22 76 58 57 73 69 30 38 52 44 32 33 77 54 67 6e 4b 70 67 55 67 62 68 42 37 4a 58 49 34 76 6d 45 4b 31 47 67 61 71 4e 72 62 52 4e 73 22 0a 20 20 0a 20 20 76 61 72 20 75 73 65 72 49 64 43 6f 6f 6b 69 65 Data Ascii: 4646(function (w) { // Begin doc var is_dev = false; if ( false ) { is_dev = true; } var disable_sync = false; if ( true ) { disable_sync = true } var tip = "vXWsi08RD23wTgnKpgUgbhB7JXI4vmEK1GgaqNrbRNs" var userIdCookie
2024-04-26 17:14:58 UTC	1806	IN	Data Raw: 69 66 28 22 22 21 3d 63 61 6d 70 43 6f 6f 6b 69 65 4e 61 6d 65 29 74 72 79 7b 43 6f 6f 6b 69 65 73 2e 65 78 70 69 72 65 43 61 6d 70 61 69 67 6e 43 6f 6f 6b 69 65 73 28 34 29 2c 73 65 74 43 61 6d 70 61 69 67 6e 43 6f 6f 6b 69 65 28 29 2c 65 78 70 69 72 65 43 61 6d 70 61 69 67 6e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 28 29 2c 73 65 74 43 61 6d 70 61 69 67 6e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 69 66 28 22 22 21 3d 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 61 6c 75 65 26 26 43 6f 6f 6b 69 65 73 2e 67 65 74 28 22 73 61 2d 75 73 65 72 2d 69 64 22 29 21 3d 75 73 65 72 49 64 43 6f 6f 6b 69 65 56 61 6c 75 65 29 74 72 79 7b 73 65 74 55 73 65 72 49 64 43 6f 6f 6b 69 65 28 29 2c 73 65 74 55 73 65 72 49 64 43 6f 6f 6b 69 65 56 32 28 Data Ascii: if(""!=campCookieName)try{Cookies.expireCampaignCookies(4),setCampaignCookie(),expireCampaignLocalStorage(),setCampaignLocalStorage()}catch(e){}if(""!=userIdCookieValue&&Cookies.get("sa-user-id")!=userIdCookieValue)try{setUserIdCookie(),setUserIdCookieV2(
2024-04-26 17:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
670	192.168.2.5	50698	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	704	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696487&i=gtm&dwt=79&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,18e58095c1343f18c09d7765e5b3c055,10.0.0.207,36146,102.129.152.220,,232877352149,1,1714151698.178,0.002,,.,0,0,0.000,0.000,-,0,0,203,130,65,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
671	192.168.2.5	50708	172.64.144.225	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:57 UTC	815	OUT	GET /attribution_tracking/conversions/4647.js?p=https://www.xero.com/us/signup/&e=undefined HTTP/1.1 Host: tracking.g2crowd.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _session_id=eef7483c5c58c254b56a96a7aacb6ff9; __cf_bm=sKffacXb53u_QJt4jLSCYZ5Hq8Og8h0bozkWBVGAIL4-1714151591-1.0.1.1-QKEJfB.Abwc.0QYu8PDZbG2WISBQoAgaDNed3TqKHvvrftZet78EKg1uriE6VhQ0zGMrmeWxCCUg8.tXXAlN3Q
2024-04-26 17:14:58 UTC	1313	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:58 GMT Content-Type: text/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=600, public set-cookie: _session_id=eef7483c5c58c254b56a96a7aacb6ff9; path=/; expires=Fri, 10 May 2024 17:14:58 GMT; HttpOnly; secure; SameSite=None etag: W/"3dae93a05edd9dcfc1864b87178a31e0" x-request-id: 55db71d6-2ce9-474f-a633-1d29a288e4c8 x-runtime: 0.003697 strict-transport-security: max-age=604800 x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block x-download-options: noopen x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin content-security-policy: default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a83651b9b6a578-MIA
2024-04-26 17:14:58 UTC	22	IN	Data Raw: 31 30 0d 0a 2f 2f 20 54 72 61 63 6b 69 6e 67 20 46 69 6c 65 0d 0a Data Ascii: 10// Tracking File
2024-04-26 17:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
672	192.168.2.5	50715	13.35.116.97	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	828	OUT	POST /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&page_title=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive Content-Length: 63 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151692\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:58 UTC	63	OUT	Data Raw: 7b 22 73 72 63 22 3a 22 74 61 67 22 2c 22 61 75 74 68 22 3a 22 42 47 43 53 44 6b 35 4c 45 48 4f 34 4d 50 56 70 67 44 52 4e 75 50 75 65 33 4d 4a 56 35 47 75 64 4d 31 70 30 45 49 42 6b 22 7d Data Ascii: {"src":"tag","auth":"BGCSDk5LEHO4MPVpgDRNuPue3MJV5GudM1p0EIBk"}
2024-04-26 17:14:58 UTC	951	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Content-Length: 3740 Connection: close Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Access-Control-Allow-Origin: https://www.xero.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: x-amz-cf-id Access-Control-Max-Age: 7200 Access-Control-Allow-Credentials: true Api-Version: v2 Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Identification-Source: CACHE Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 25 Apr 2024 17:14:58 GMT Vary: Accept-Encoding, Origin Request-ID: a855198e-fe7b-4c51-8ee8-8d0e4e29b9e8 X-Cache: Miss from cloudfront Via: 1.1 33193046475e96dea23c35606f55483e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: KqPlpBL5uwjJzjf9Zdp3MygRarHrxL2rn8El8U-y0r3gyHcOr7wkdg==
2024-04-26 17:14:58 UTC	3740	IN	Data Raw: 7b 22 68 71 22 3a 7b 22 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 64 65 6d 61 6e 64 62 61 73 65 5f 73 69 64 22 3a 32 37 33 34 30 32 30 36 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 61 6c 69 61 73 22 3a 22 43 6f 6e 73 65 72 76 69 63 65 22 2c 22 69 6e 64 75 73 74 72 79 22 3a 22 42 75 73 69 6e 65 73 73 20 53 65 72 76 69 63 65 73 22 2c 22 73 75 62 5f 69 6e 64 75 73 74 72 79 22 3a 22 47 65 6e 65 72 61 6c 22 2c 22 65 6d 70 6c 6f 79 65 65 5f 63 6f 75 6e 74 22 3a 32 31 38 34 2c 22 70 72 69 6d 61 72 79 5f 73 69 63 22 3a 22 37 33 38 39 22 2c 22 70 72 69 6d 61 72 79 5f 6e 61 69 63 73 22 3a 6e 75 6c 6c 2c 22 73 74 72 65 65 74 5f 61 64 64 72 65 73 73 22 3a 22 35 39 35 20 53 20 38 30 20 45 20 53 74 65 20 33 30 30 22 2c 22 63 69 74 79 Data Ascii: {"hq":{"company_name":"Conservice","demandbase_sid":27340206,"marketing_alias":"Conservice","industry":"Business Services","sub_industry":"General","employee_count":2184,"primary_sic":"7389","primary_naics":null,"street_address":"595 S 80 E Ste 300","city

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
673	192.168.2.5	50705	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	711	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696665&i=gtm&dwt=2&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,317ecd31b63c10f9f79ae5a93083b93c,10.0.0.207,57774,102.129.152.220,,361522351577,1,1714151698.278,0.002,,.,0,0,0.000,0.000,-,0,0,203,241,120,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
674	192.168.2.5	50707	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	711	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696669&i=gtm&dwt=2&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,abea281d74c3feb32ca5a9814948fda0,10.0.0.207,23292,102.129.152.220,,232624006224,1,1714151698.278,0.002,,.,0,0,0.000,0.000,-,0,0,203,201,100,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
675	192.168.2.5	50712	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	910	OUT	GET /rp.gif?ts=1714151696607&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:58 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
676	192.168.2.5	50713	151.101.193.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	910	OUT	GET /rp.gif?ts=1714151696608&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:58 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
677	192.168.2.5	50703	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	1373	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:58 UTC	1254	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
678	192.168.2.5	50704	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	1384	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:58 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:58 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
679	192.168.2.5	50709	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	1336	OUT	GET /activityi;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:58 UTC	1217	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://9401320.fls.doubleclick.net/activityi;dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
680	192.168.2.5	50720	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	479	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695748&i=gtm&dwt=1&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,a533d85d026662fdd2e274a8ffddb990,10.0.0.207,23668,102.129.152.220,,232624006681,1,1714151698.345,0.005,,.,0,0,0.000,0.004,-,0,0,203,227,113,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
681	192.168.2.5	50721	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	474	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695742&i=gtm&dwt=2277&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,b967a12f72be5d33e6fb088394ef9812,10.0.0.207,58264,102.129.152.220,,361522352035,1,1714151698.344,0.004,,.,0,0,0.000,0.004,-,0,0,203,198,99,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
682	192.168.2.5	50723	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	471	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695744&i=gtm&dwt=1&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,621aa053e4ec1d63d9ee6bba564f8eb5,10.0.0.207,58314,102.129.152.220,,361522352085,1,1714151698.350,0.006,,.,0,0,0.000,0.004,-,0,0,203,176,88,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
683	192.168.2.5	50716	34.96.71.22	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	782	OUT	GET /s/sync?exc=lr HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151692\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:58 UTC	510	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET,OPTIONS Content-Type: text/html; charset=UTF-8 Set-Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1714151698\|ix:0\|mctv:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Fri, 26 Apr 2024 17:14:58 GMT Content-Length: 74 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:58 UTC	74	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Pixels</title></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
684	192.168.2.5	50722	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	480	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695923&i=gtm&dwt=10&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,92cc5dc0bdb34e832cede0719465c2ee,10.0.0.207,36656,102.129.152.220,,232877352754,1,1714151698.350,0.006,,.,0,0,0.000,0.004,-,0,0,203,122,61,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
685	192.168.2.5	50706	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	1465	OUT	GET /td/rul/1023673485?random=1714151696676&cv=11&fst=1714151696676&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:58 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:58 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
686	192.168.2.5	50710	142.250.217.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	1347	OUT	GET /td/fls/rul/activityi;fledge=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:58 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:58 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
687	192.168.2.5	50717	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	1455	OUT	GET /pagead/1p-conversion/1023673485/?random=1728995835&cv=11&fst=1714151690667&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Accounting%20Software%20%E2%80%93%20Do%20Beautiful%20Business%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABSidldmVudC1zb3VyY2UsIHRyaWdnZXI7bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=COG65r3EhL3bJCITCPPiutaw4IUDFQStgwgdN5oGtjICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLOhVodHRwczovL3d3dy54ZXJvLmNvbS8&is_vtc=1&cid=CAQSKQB7FLtqd8gBf05OTZTamWKGBhbffL8fi_fHGTSPLLWxanOxFUl7JzHp&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaJ5RFsst6Nr7x2IFFvfMmIR0ukeYigPN4w&random=294050109 [TRUNCATED] Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:14:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
688	192.168.2.5	50725	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	472	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151695964&i=gtm&dwt=35&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,4359ba1410d7bed1f2da5a8d418e1cef,10.0.0.207,59136,102.129.152.220,,361522352760,1,1714151698.445,0.004,,.,0,0,0.000,0.004,-,0,0,203,176,88,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
689	192.168.2.5	50726	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	473	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696133&i=gtm&dwt=154&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,5620f2b8c6141a85c54783b560bcf61c,10.0.0.207,37906,102.129.152.220,,232877353950,1,1714151698.454,0.002,,.,0,0,0.000,0.000,-,0,0,203,140,70,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
690	192.168.2.5	50729	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	678	OUT	GET /rp.gif?ts=1714151696608&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:58 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
691	192.168.2.5	50730	151.101.129.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	678	OUT	GET /rp.gif?ts=1714151696607&id=t2_ewwvmnuh&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=49cba347-b0c4-4667-b682-b6bf97a82308&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_3ba1cddf&dpm=&dpcc=&dprc= HTTP/1.1 Host: alb.reddit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	828	IN	HTTP/1.1 200 OK Connection: close Content-Length: 42 Server: Varnish Retry-After: 0 cross-origin-resource-policy: cross-origin content-type: image/gif Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:14:58 GMT Via: 1.1 varnish Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
2024-04-26 17:14:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
692	192.168.2.5	50731	146.75.124.157	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	625	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "bbbcf811d8437a575d796a4c1e5d4fad" If-Modified-Since: Thu, 04 Apr 2024 00:26:35 GMT
2024-04-26 17:14:58 UTC	339	IN	HTTP/1.1 304 Not Modified Connection: close Date: Fri, 26 Apr 2024 17:14:58 GMT Cache-Control: no-cache ETag: "bbbcf811d8437a575d796a4c1e5d4fad" X-Served-By: cache-mia-kmia1760068-MIA X-Cache: HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
693	192.168.2.5	50735	13.35.116.50	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	569	OUT	GET /api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&page_title=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US HTTP/1.1 Host: api.company-target.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=7c305adb-e298-42d1-9636-4375d0a2692c; tuuid_lu=1714151692\|ix:0\|mctv:0\|rp:0
2024-04-26 17:14:58 UTC	491	IN	HTTP/1.1 401 Unauthorized Content-Type: text/plain;charset=utf-8 Content-Length: 12 Connection: close Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx WWW-Authenticate: DemandBase API v2 X-Content-Type-Options: nosniff Request-ID: def4308c-8c1b-4ed3-9624-564d0490ae30 Vary: Origin X-Cache: Error from cloudfront Via: 1.1 9116843e269dabf0500134fa62bba0b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C2 X-Amz-Cf-Id: qjrOvZKn3bmBPHJHyQyzTRAsdpnnfgkbK-ZAmgeT0rdtcQR8ZQsEzQ==
2024-04-26 17:14:58 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
694	192.168.2.5	50734	13.32.87.128	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	635	OUT	GET /bg9s?x-amz-cf-id=KqPlpBL5uwjJzjf9Zdp3MygRarHrxL2rn8El8U-y0r3gyHcOr7wkdg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:58 UTC	601	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 26 Apr 2024 09:25:13 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 429fb4e05d6db25afd75d7eb9f5fa85c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: 1sVgW-vJvwc9WzRzYzIPyOgGsw6tN7ozEOuTKmLyxPSQZ5cC-WMqUA== Age: 28186 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
695	192.168.2.5	50736	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	3218	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&t=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&tip=vXWsi08RD23wTgnKpgUgbhB7JXI4vmEK1GgaqNrbRNs&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:59 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:59 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
696	192.168.2.5	50737	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	3174	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&t=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&tip=vXWsi08RD23wTgnKpgUgbhB7JXI4vmEK1GgaqNrbRNs&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:14:59 UTC	295	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:14:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:14:59 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
697	192.168.2.5	50738	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	473	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696375&i=gtm&dwt=119&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:59 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:58 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,dbbe103b1188ed03ea5747d941fa743e,10.0.0.207,56340,102.129.152.220,,8589430084,1,1714151698.999,0.003,,.,0,0,0.000,0.000,-,0,0,203,156,78,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:59 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
698	192.168.2.5	50739	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	472	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696487&i=gtm&dwt=79&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:59 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:59 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,f93568af4f64dbdc79b1cf1f000afe93,10.0.0.207,62736,102.129.152.220,,361522356282,1,1714151699.002,0.003,,.,0,0,0.000,0.000,-,0,0,203,156,78,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:59 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
699	192.168.2.5	50740	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	479	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696669&i=gtm&dwt=2&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:59 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:59 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,436615a163b0960587458e41c49512b6,10.0.0.207,56400,102.129.152.220,,8589430122,1,1714151699.005,0.001,,.,0,0,0.004,0.004,-,0,0,203,156,78,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:59 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
700	192.168.2.5	50741	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	479	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2F&tag=DwellTime&ts=1714151696665&i=gtm&dwt=2&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:14:59 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:14:59 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,06f05d3bd50d00dc980dd7289bf2533e,10.0.0.207,62772,102.129.152.220,,361522356325,1,1714151699.010,0.001,,.,0,0,0.000,0.000,-,0,0,203,186,93,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:14:59 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
701	192.168.2.5	50742	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:14:58 UTC	1370	OUT	GET /activityi;dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:14:59 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:14:59 GMT Expires: Fri, 26 Apr 2024 17:14:59 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:14:59 UTC	592	IN	Data Raw: 32 63 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 49 54 50 79 4e 69 77 34 49 55 44 46 52 Data Ascii: 2c5<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CITPyNiw4IUDFR
2024-04-26 17:14:59 UTC	124	IN	Data Raw: 30 3b 65 70 76 65 72 3d 32 3b 6d 61 74 63 68 5f 69 64 3d 31 36 32 64 66 66 36 35 2d 64 61 31 32 2d 34 62 63 36 2d 61 64 36 32 2d 36 62 31 32 64 35 66 31 34 36 35 31 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 73 69 67 6e 75 70 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F"/></body></html>
2024-04-26 17:14:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
702	192.168.2.5	50743	142.250.217.166	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	1407	OUT	GET /activityi;dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: 9401320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:00 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:00 GMT Expires: Fri, 26 Apr 2024 17:15:00 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:15:00 UTC	592	IN	Data Raw: 32 65 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4b 53 30 31 4e 69 77 34 49 55 44 46 62 Data Ascii: 2ea<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CKS01Niw4IUDFb
2024-04-26 17:15:00 UTC	161	IN	Data Raw: 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 70 73 63 64 6c 3d 6e 6f 61 70 69 3b 67 74 6d 3d 34 35 66 65 34 34 6f 30 7a 38 38 33 30 39 32 33 34 37 30 7a 61 32 30 31 3b 67 63 64 3d 31 33 6c 33 6c 33 6c 33 6c 31 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 73 69 67 6e 75 70 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: dows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F"/></body></html>
2024-04-26 17:15:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
703	192.168.2.5	50746	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	678	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:00 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:00 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,6f6e104035f17282fdd07d2da85f42b2,10.0.0.207,48760,102.129.152.220,,232877366438,1,1714151700.758,0.002,,.,0,0,0.000,0.000,-,0,0,203,119,59,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:00 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
704	192.168.2.5	50747	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	1355	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source=navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:00 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"6005408323475361406","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_typ [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:15:00 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
705	192.168.2.5	50744	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	1161	OUT	GET /ddm/fls/z/dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
706	192.168.2.5	50748	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	1318	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source;navigation-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:00 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11873054584441745431","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:15:00 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
707	192.168.2.5	50750	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	673	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=xcnk+eZDxpmwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:15:00 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=/tLqZUVQ5tOwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:15:00 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:15:00 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:15:00 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
708	192.168.2.5	50749	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	925	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151696751&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&st=1714151696751&et=1714151696751&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=4NjjGYnexy_ElxMfTKnM9IuqHHrFAZ0Qyr-LJyu_DuNXslglAChviFrM0Mc4sTmGHDluEYVpBIQI_WmCUBLlb3lLXPC-qEICvTD5X-RXOXE.; receive-cookie-deprecation=1; uuid2=2808008891046894518
2024-04-26 17:15:00 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:15:00 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:15:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
709	192.168.2.5	50755	142.250.64.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	939	OUT	GET /recaptcha/api2/anchor?ar=1&k=6Le6fDsoAAAAABLpuIc7lmLNZEa2f-gLLKbb4bnV&co=aHR0cHM6Ly93d3cueGVyby5jb206NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=j80nlnbc54q7 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-GsvA22w9QjKKqIdpaiQ98g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:15:01 UTC	364	IN	Data Raw: 36 33 38 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 6383<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 47 73 76 41 32 32 77 39 51 6a 4b 4b 71 49 64 70 61 69 51 39 38 67 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css"><script nonce="GsvA22w9QjKKqIdpaiQ98g" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 38 67 37 73 77 46 38 4b 2d 62 56 75 6a 30 66 34 4e 35 38 48 34 4c 72 35 42 72 46 46 66 71 4f 33 79 77 36 4f 6b 73 4e 44 58 46 5f 46 79 42 48 46 35 59 4f 73 58 64 72 50 34 67 51 50 67 74 34 48 71 59 53 45 72 46 64 32 7a 55 68 63 4e 4a 42 51 50 6b 6e 68 74 77 7a 71 4e 49 55 46 75 4a 76 52 52 57 4f 73 43 6f 37 6c 68 61 59 31 55 5f 78 2d 6f 5f 30 32 47 6b 4d 38 63 67 6b 37 64 65 73 4e 70 75 55 77 49 79 56 68 32 65 4a 5a 75 35 38 31 34 39 7a 4c 6a 33 69 77 48 45 5a 4d 72 69 70 72 43 38 57 4e 41 38 74 32 61 6e 70 72 68 5a 30 61 41 51 55 4a 61 74 42 59 73 36 48 52 46 51 71 55 4a 38 30 70 55 38 42 65 32 6d 75 48 44 73 69 68 58 51 37 76 63 38 64 6b 4a 76 39 4e 35 68 54 47 59 35 4c 31 6f 76 7a 7a 31 59 4f 70 71 6e 4f 6a 64 46 4b 52 4e 35 6b 71 46 57 72 59 54 5a 65 Data Ascii: 8g7swF8K-bVuj0f4N58H4Lr5BrFFfqO3yw6OksNDXF_FyBHF5YOsXdrP4gQPgt4HqYSErFd2zUhcNJBQPknhtwzqNIUFuJvRRWOsCo7lhaY1U_x-o_02GkM8cgk7desNpuUwIyVh2eJZu58149zLj3iwHEZMriprC8WNA8t2anprhZ0aAQUJatBYs6HRFQqUJ80pU8Be2muHDsihXQ7vc8dkJv9N5hTGY5L1ovzz1YOpqnOjdFKRN5kqFWrYTZe
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 2d 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 47 73 76 41 32 32 77 39 51 6a 4b 4b 71 49 64 70 61 69 51 39 38 67 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 32 62 67 64 61 74 61 5c 78 32 32 2c 5c 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 73 61 31 52 59 63 54 51 35 57 55 63 31 58 32 56 71 4d 58 63 33 62 54 52 55 4f 55 35 33 58 7a 46 4d 65 44 46 50 59 32 51 78 5a 33 52 6c 56 31 46 77 63 32 5a 57 58 31 52 72 4c 6d 70 7a 5c 78 32 32 2c 5c 78 32 32 5c 78 32 32 2c 5c 78 32 32 64 48 64 4a 55 55 64 33 Data Ascii: -"><script type="text/javascript" nonce="GsvA22w9QjKKqIdpaiQ98g"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9sa1RYcTQ5WUc1X2VqMXc3bTRUOU53XzFMeDFPY2QxZ3RlV1Fwc2ZWX1RrLmpz\x22,\x22\x22,\x22dHdJUUd3
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 62 6d 35 4b 5a 32 52 69 56 54 56 70 52 6e 56 44 54 44 46 6c 59 6e 4a 71 56 44 55 30 63 6d 31 4d 54 54 52 46 61 44 56 4f 5a 30 70 4d 62 58 52 6e 64 6e 67 79 62 7a 56 61 62 44 52 44 65 44 63 30 56 30 78 34 56 6e 6c 6b 4f 47 78 6b 59 6b 52 73 5a 46 49 78 4e 32 78 71 63 6c 6c 7a 52 56 56 32 56 48 4e 68 57 6c 45 34 63 48 63 34 5a 45 6c 73 4e 55 46 4d 63 6a 41 72 54 6a 4a 54 51 57 4e 48 59 6b 39 77 4d 56 4a 47 56 45 64 43 62 44 6c 73 4f 57 30 35 52 57 46 31 64 7a 67 34 4b 7a 56 6c 55 33 6c 55 5a 46 56 7a 64 30 4d 31 61 6e 4e 5a 65 45 31 50 65 46 5a 48 51 33 51 32 5a 30 46 75 54 7a 55 72 56 57 78 42 57 58 4a 31 53 6b 5a 71 53 57 74 6b 53 57 64 75 65 57 77 7a 56 6e 52 47 59 6e 42 5a 5a 6a 56 61 56 58 5a 54 5a 79 74 49 61 57 39 57 4b 33 4e 7a 55 58 56 52 53 6a 41 Data Ascii: bm5KZ2RiVTVpRnVDTDFlYnJqVDU0cm1MTTRFaDVOZ0pMbXRndngybzVabDRDeDc0V0x4VnlkOGxkYkRsZFIxN2xqcllzRVV2VHNhWlE4cHc4ZElsNUFMcjArTjJTQWNHYk9wMVJGVEdCbDlsOW05RWF1dzg4KzVlU3lUZFVzd0M1anNZeE1PeFZHQ3Q2Z0FuTzUrVWxBWXJ1SkZqSWtkSWdueWwzVnRGYnBZZjVaVXZTZytIaW9WK3NzUXVRSjA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
710	192.168.2.5	50751	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	893	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A56%20GMT&n=-2d&b=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:15:01 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:00 GMT Expires: Fri, 26 Apr 2024 17:15:00 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:15:00 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:15:01 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
711	192.168.2.5	50754	142.250.64.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	977	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh&co=aHR0cHM6Ly93d3cueGVyby5jb206NDQz&hl=en&type=image&v=V6_85qpc2Xf2sbe3xTnRte7m&theme=light&size=normal&badge=bottomright&cb=4sv6t3ujo84u HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-fekAeFvCdsSckr5jBDbU0w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:15:01 UTC	364	IN	Data Raw: 32 62 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2b0d<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 66 65 6b 41 65 46 76 43 64 73 53 63 6b 72 35 6a 42 44 62 55 30 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css"><script nonce="fekAeFvCdsSckr5jBDbU0w" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 47 53 38 6f 46 68 50 69 72 6c 34 71 6c 72 38 6a 53 62 4e 31 6a 79 66 7a 56 75 37 7a 33 6b 74 2d 71 55 2d 39 4a 72 4f 72 43 73 5f 4a 49 41 67 64 30 33 47 44 71 64 6d 42 49 35 45 5a 61 4a 32 63 66 37 59 46 50 65 63 50 46 74 38 4e 52 6d 43 64 72 6c 53 6b 4e 38 71 33 4f 35 44 4a 79 50 4e 51 48 64 55 30 63 34 5a 4a 55 77 4f 57 6e 6e 45 65 50 4d 30 4a 6b 45 61 36 54 6c 50 79 4d 34 35 50 73 33 75 55 7a 78 77 30 6a 71 57 79 4f 52 64 68 70 61 41 54 5a 4a 52 33 6f 46 31 38 34 38 41 4d 68 5f 65 30 4b 54 67 6f 54 56 73 74 70 4e 4c 56 4e 6b 30 6a 6f 46 45 73 6a 30 6c 39 47 35 34 77 44 48 4f 6e 64 2d 44 55 57 70 76 34 7a 63 7a 32 44 4b 4c 56 2d 7a 79 65 46 4a 6f 6f 63 55 5a 71 62 6b 50 66 65 64 4b 55 54 49 45 30 72 55 5a 4f 46 35 78 69 5a 59 47 2d 33 76 31 77 49 56 62 Data Ascii: GS8oFhPirl4qlr8jSbN1jyfzVu7z3kt-qU-9JrOrCs_JIAgd03GDqdmBI5EZaJ2cf7YFPecPFt8NRmCdrlSkN8q3O5DJyPNQHdU0c4ZJUwOWnnEePM0JkEa6TlPyM45Ps3uUzxw0jqWyORdhpaATZJR3oF1848AMh_e0KTgoTVstpNLVNk0joFEsj0l9G54wDHOnd-DUWpv4zcz2DKLV-zyeFJoocUZqbkPfedKUTIE0rUZOF5xiZYG-3v1wIVb
2024-04-26 17:15:01 UTC	1255	IN	Data Raw: 34 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 66 65 6b 41 65 46 76 43 64 73 53 63 6b 72 35 6a 42 44 62 55 30 77 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 32 62 67 64 61 74 61 5c 78 32 32 2c 5c 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 73 61 31 52 59 63 54 51 35 57 55 63 31 58 32 56 71 4d 58 63 33 62 54 52 55 4f 55 35 33 58 7a 46 4d 65 44 46 50 59 32 51 78 5a 33 52 6c 56 31 46 77 63 32 5a 57 58 31 52 72 4c 6d 70 7a 5c 78 32 32 2c 5c 78 32 32 5c 78 32 32 2c 5c 78 32 32 64 48 64 4a 54 6e 52 5a Data Ascii: 4"><script type="text/javascript" nonce="fekAeFvCdsSckr5jBDbU0w"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9sa1RYcTQ5WUc1X2VqMXc3bTRUOU53XzFMeDFPY2QxZ3RlV1Fwc2ZWX1RrLmpz\x22,\x22\x22,\x22dHdJTnRZ
2024-04-26 17:15:01 UTC	625	IN	Data Raw: 59 32 39 6a 52 55 73 35 57 6d 70 34 64 55 5a 46 56 33 64 45 5a 30 51 72 54 7a 52 70 51 6d 78 42 52 57 77 7a 4d 32 31 34 51 6b 56 49 4f 55 64 6d 64 54 45 32 54 32 56 6a 59 6b 68 6c 55 58 6b 31 52 47 52 69 4b 30 74 46 53 55 68 71 61 48 6c 6f 4f 58 68 36 55 55 39 53 52 30 49 32 63 58 68 46 4e 6b 74 6e 62 7a 4e 4e 63 44 5a 45 4b 30 4a 43 52 46 6c 6c 52 56 6c 48 4f 48 6c 55 55 6e 4e 6f 54 46 6c 72 61 48 70 76 62 6d 46 6f 5a 6d 52 59 5a 57 31 76 55 31 70 59 59 33 64 35 54 6e 5a 32 51 30 4a 36 65 6b 49 76 55 57 5a 53 57 54 5a 35 54 44 42 55 4e 6b 4a 36 64 32 68 72 63 58 70 53 55 46 5a 30 61 57 78 5a 62 54 56 36 52 44 42 79 5a 57 74 47 5a 56 67 32 56 46 42 54 54 33 46 4e 63 55 78 46 63 6b 77 30 52 6d 4a 4a 56 7a 52 4e 54 45 4e 6c 51 57 38 32 56 32 68 4a 53 6a 42 Data Ascii: Y29jRUs5Wmp4dUZFV3dEZ0QrTzRpQmxBRWwzM214QkVIOUdmdTE2T2VjYkhlUXk1RGRiK0tFSUhqaHloOXh6UU9SR0I2cXhFNktnbzNNcDZEK0JCRFllRVlHOHlUUnNoTFlraHpvbmFoZmRYZW1vU1pYY3d5TnZ2Q0J6ekIvUWZSWTZ5TDBUNkJ6d2hrcXpSUFZ0aWxZbTV6RDByZWtGZVg2VFBTT3FNcUxFckw0RmJJVzRNTENlQW82V2hJSjB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
712	192.168.2.5	50752	67.220.226.233	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	652	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151699211 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:15:01 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: GWQ6FDKB2H603G64YV4B Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:15:01 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:15:01 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:15:01 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
713	192.168.2.5	50753	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:00 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: onbx57CCs0zfbsScdfZ4JA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:01 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:01 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
714	192.168.2.5	50756	99.80.149.126	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	627	OUT	POST /?site_id=3197823&gzip=1 HTTP/1.1 Host: content.hotjar.io Connection: keep-alive Content-Length: 29776 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain; charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	16384	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a ec bd eb 76 db c8 b2 26 f8 2a 68 af b5 6b 5f ba 44 e3 96 89 44 cd 78 ce 88 d4 c5 b2 44 59 16 29 55 d9 73 66 79 25 49 88 84 45 02 34 08 4a 96 4f 9f 9f fd 2c bd fa 7f bf c1 7e b1 89 48 50 b2 e8 14 20 84 2b 73 ef 9a 3e c7 b5 37 c5 24 2e 99 11 c8 8c 88 8c f8 22 f0 6f 2f 26 f9 78 78 b7 4c 5e fc f2 e2 ff fc 2f 7b 6f 7b c3 f7 67 fb ce ac 5c cc ff af 7f cd 5e fc fc a2 c8 f3 f2 68 f2 e2 17 ef e7 17 e3 59 3a 9f 14 49 f6 e2 97 ff e7 df 5e 64 f9 24 a9 2e f3 dc 9f 5f a4 70 86 ff f3 8b 4c 2e f0 3e 78 35 5c ba 5c 8f e6 e9 18 2f 7e 01 ad d5 dd aa 4c 16 55 eb df 7f de ba 41 75 7d f0 f3 8b 52 4e 4f ab 5b bc 1e f6 4f e0 22 59 96 45 3a 5a 97 c9 ea c5 2f ff f6 62 2e b3 29 1c 83 11 fc fb 66 34 a7 70 93 d5 f7 e3 a9 6e 17 6e dd 6e 7f 77 ef fb db b5 Data Ascii: v&*hk_DDxDY)Usfy%IE4JO,~HP +s>7$."o/&xxL^/{o{g\^hY:I^d$._pL.>x5\\/~LUAu}RNO[O"YE:Z/b.)f4pnnnw
2024-04-26 17:15:01 UTC	13392	OUT	Data Raw: 04 b4 8c 20 a2 65 14 97 ed 08 68 12 60 e6 d4 78 1c 56 e8 80 99 d3 e6 38 ac 20 00 66 04 11 30 73 9a da d9 71 93 f0 32 a7 c6 5f 9e 29 74 bc cc 69 f3 ab 4a 05 01 2f 23 88 78 99 d3 bc b8 ca e7 d7 1b b8 8c 15 76 93 3c a3 e6 77 2c 4f a1 65 ce 1a e4 33 01 2d 23 88 68 19 60 36 da d2 99 d3 97 05 be 1a d6 22 48 49 90 b0 33 a7 c6 33 29 84 8e 9d 39 55 99 14 35 5c 27 40 67 04 11 3a 03 5c bf 95 36 ca 25 09 12 6c e6 ad 79 df 9d 0e 9b 79 db 18 00 27 80 66 04 11 34 f3 76 61 a5 80 81 20 e1 65 ce 8c 27 ab 08 1d 2f 73 a6 92 55 ea 38 4c 50 87 44 b0 cc 99 bc 4e 2d 95 89 88 49 68 99 33 e3 f9 13 b1 8e 96 39 6b 2e 7b 12 13 00 33 31 11 30 73 06 9b 42 1b be bb 98 84 97 39 33 1e 23 8c 75 bc cc 59 53 72 7d 4c c0 cb c4 44 bc 0c f0 38 59 21 72 54 66 ce 30 29 8a b4 cc ad d4 8c 8f 49 d0 Data Ascii: eh`xV8 f0sq2_)tiJ/#xv<w,Oe3-#h`6"HI33)9U5\'@g:\6%lyy'f4va e'/sU8LPDN-Ih39k.{310sB93#uYSr}LD8Y!rTf0)I
2024-04-26 17:15:01 UTC	190	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Type: application/json Content-Length: 56 Connection: close Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400
2024-04-26 17:15:01 UTC	56	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 5f 75 75 69 64 22 3a 22 64 72 73 66 71 51 66 57 51 37 71 62 65 43 75 38 79 2d 63 6f 6c 77 22 2c 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d Data Ascii: {"content_uuid":"drsfqQfWQ7qbeCu8y-colw","success":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
715	192.168.2.5	50759	13.32.87.74	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	437	OUT	GET /bg9s?x-amz-cf-id=KqPlpBL5uwjJzjf9Zdp3MygRarHrxL2rn8El8U-y0r3gyHcOr7wkdg==&api-version=v2 HTTP/1.1 Host: tag-logger.demandbase.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	560	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Connection: close Date: Thu, 25 Apr 2024 21:27:44 GMT Last-Modified: Tue, 07 Mar 2023 20:47:02 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" x-amz-server-side-encryption: AES256 x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 2feed206ccd80c991a2378002008d9f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: mOzB6GAoRWTg-ZQdAHKGgXu5lavNGKxz3APpDutdTL7Irxs0KsOJDg== Age: 71238 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
716	192.168.2.5	50761	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	2976	OUT	GET /saq_pxl?uid=IZi8ik6wpN0HnLyT9lcuoQ&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&t=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&tip=vXWsi08RD23wTgnKpgUgbhB7JXI4vmEK1GgaqNrbRNs&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:01 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 94 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:15:01 UTC	94	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":null,"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.5	50760	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	3020	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&t=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&tip=vXWsi08RD23wTgnKpgUgbhB7JXI4vmEK1GgaqNrbRNs&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:01 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 116 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:15:01 UTC	116	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":null,"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
718	192.168.2.5	50762	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	446	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:01 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,4341bc9abd77b86d5860f94490a13097,10.0.0.207,39328,102.129.152.220,,232624024182,1,1714151701.570,0.010,,.,0,0,0.000,0.008,-,0,0,203,168,84,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:01 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
719	192.168.2.5	50763	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	1050	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:01 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:01 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"1765784595522349800"}],"aggregatable_trigger_data":[{"filters":[{"14":["9625591"]}],"key_piece":"0x834ee36aca9cc52c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xdada7e6a6d76a222","not_filters":{"14":["9625591"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["9625591"]}],"key_piece":"0x65edc90a865bb1a0","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xa86dc2e72780d995","not_filters":{"14":["9625591"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"6005408323475361406","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"1765784595522349800","filters":[{"14":["9625591"],"source_typ [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:15:01 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
720	192.168.2.5	50770	104.244.42.133	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	974	OUT	GET /i/adsct?bci=3&eci=2&event_id=6ba4850f-c278-4ceb-8231-c9c7cffe9a04&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d9a7932e-bfb1-43a7-8440-52cd896842e2&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:15:01 UTC	393	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:15:01 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: b50b0752db766817 strict-transport-security: max-age=0 x-response-time: 78 x-connection-hash: 6753b8a55f94c63a8be9497ba9a7aef0f3bdc6844a6c3e34a021e22d625b9dfd connection: close
2024-04-26 17:15:01 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
721	192.168.2.5	50766	35.244.154.8	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	441	OUT	GET /464526.gif HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; rlas3=/tLqZUVQ5tOwCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=
2024-04-26 17:15:01 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=cIKMna3g232wCOskw1xQ5FHnwUo1Dv8b0T3g6ZSscPc=; Path=/; Domain=rlcdn.com; Expires=Sat, 26 Apr 2025 17:15:01 GMT; Secure; SameSite=None Set-Cookie: pxrc=CK3Br7EGEgUI6AcQABIGCMrdKhAA; Path=/; Domain=rlcdn.com; Expires=Tue, 25 Jun 2024 17:15:01 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
722	192.168.2.5	50767	68.67.179.153	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	541	OUT	GET /pixie?e=LandingPage&pi=a8c07fef-3f0b-43ec-b0fb-3e4bc99c03b5&it=1714151696751&v=0.0.24&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&st=1714151696751&et=1714151696751&if=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=2808008891046894518
2024-04-26 17:15:01 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Fri, 26 Apr 2024 17:15:01 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 102.129.152.220; 102.129.152.220; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-04-26 17:15:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
723	192.168.2.5	50768	172.217.3.70	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 135 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	135	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 36 30 30 35 34 30 38 33 32 33 34 37 35 33 36 31 34 30 36 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"6005408323475361406"},"type":"trigger-no-matching-source"}]
2024-04-26 17:15:02 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:15:02 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
724	192.168.2.5	50769	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	914	OUT	GET /ddm/fls/z/dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:01 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
725	192.168.2.5	50765	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	1013	OUT	GET /activity;register_conversion=1;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:01 UTC	2233	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:01 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16002473111226397409"}],"aggregatable_trigger_data":[{"filters":[{"14":["11394278"]}],"key_piece":"0x71ae5c3c960e09d5","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xba670a95956cddf3","not_filters":{"14":["11394278"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":[{"14":["11394278"]}],"key_piece":"0x34663f6b9467c95d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc7f0a8127fc4a942","not_filters":{"14":["11394278"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11873054584441745431","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16002473111226397409","filters":[{"14":["11394278"],"so [TRUNCATED] Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sun, 26-May-2024 17:15:01 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
726	192.168.2.5	50772	172.217.3.70	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 78 65 72 6f 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 31 38 37 33 30 35 34 35 38 34 34 34 31 37 34 35 34 33 31 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://xero.com","trigger_debug_key":"11873054584441745431"},"type":"trigger-no-matching-source"}]
2024-04-26 17:15:01 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:15:01 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
727	192.168.2.5	50771	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	661	OUT	GET /sp.pl?a=10000&d=Fri%2C%2026%20Apr%202024%2017%3A14%3A56%20GMT&n=-2d&b=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:15:01 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:01 GMT Expires: Fri, 26 Apr 2024 17:15:01 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:15:01 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
728	192.168.2.5	50777	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	861	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699241&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:01 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=1, ullat=1 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:15:01 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
729	192.168.2.5	50778	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	688	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151699211 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Attribution-Reporting-Eligible: trigger;event-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:15:01 GMT x-amzn-RequestId: 8fd4eb26-d190-48c2-86a5-96c8ba6e5c3e Access-Control-Allow-Origin: https://www.xero.com Vary: Origin Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Access-Control-Allow-Credentials: true X-Cache: Miss from cloudfront Via: 1.1 56b1a3258b9fc2318762088949ab9414.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: CAelDF7SweCSPVU8bSmfQIqd2I9z13uqqplKIPzV_nW-Ls583pIe0w==
2024-04-26 17:15:02 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.5	50775	104.244.42.195	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	995	OUT	GET /i/adsct?bci=3&eci=2&event_id=6ba4850f-c278-4ceb-8231-c9c7cffe9a04&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d9a7932e-bfb1-43a7-8440-52cd896842e2&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:15:02 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:15:01 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: f4b43ff3cc66a83f strict-transport-security: max-age=631138519 x-response-time: 86 x-connection-hash: 54b282917278368432edbdb0129cfaaf5de833aee7df463bc2a4f65ae74573bb connection: close
2024-04-26 17:15:02 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
731	192.168.2.5	50776	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	1387	OUT	GET /pixel;r=1021613849;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151699215;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Sign%20up%20for%20free%20trial%2Cdescription.Xero%20free%20trial%20for%2030%20days%252E%20Sign%20up%20to%20try%20Xero%20for%20your%20business%20free%20or%20subsc%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Fsignup%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=008290c7-0498-4c7a-b8c6-7875d3cba596;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:15:02 UTC	282	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:02 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:15:02 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
732	192.168.2.5	50781	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:01 UTC	971	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699241&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger;navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:15:02 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:15:02 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:15:02 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
733	192.168.2.5	50783	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	890	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699244&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:15:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
734	192.168.2.5	50784	104.244.42.69	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	742	OUT	GET /i/adsct?bci=3&eci=2&event_id=6ba4850f-c278-4ceb-8231-c9c7cffe9a04&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d9a7932e-bfb1-43a7-8440-52cd896842e2&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=a5e7247a-61c4-44c8-9f92-c02063807899
2024-04-26 17:15:02 UTC	392	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:15:01 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: ffe0fb184c008091 strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: 24327cb7d31436d18569b3909eb53a9be3295aa5e2a4792ee4470b811cf7c6df connection: close
2024-04-26 17:15:02 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
735	192.168.2.5	50779	52.94.222.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	481	OUT	GET /s/iu3?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151699211 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; ad-privacy=0
2024-04-26 17:15:02 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Fri, 26 Apr 2024 17:15:02 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 65 Connection: close x-amz-rid: 7TQAQ0VABBBZGAFMZ6TW Set-Cookie: ad-id=A-WFIrkKAUP6rxHKWkQIsWs; Domain=.amazon-adsystem.com; Expires=Wed, 01-Jan-2025 17:15:02 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Sun, 01-Jul-2029 17:15:02 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2024-04-26 17:15:02 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
736	192.168.2.5	50758	142.250.64.226	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	1198	OUT	GET /ddm/fls/z/dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://9401320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:03 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:03 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
737	192.168.2.5	50786	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	629	OUT	GET /tr/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699241&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:15:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
738	192.168.2.5	50785	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	982	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699244&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:15:02 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:15:02 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:15:02 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
739	192.168.2.5	50782	52.209.193.176	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	364	OUT	GET /?site_id=3197823&gzip=1 HTTP/1.1 Host: content.hotjar.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 11 Connection: close
2024-04-26 17:15:02 UTC	11	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
740	192.168.2.5	50788	18.173.166.129	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	436	OUT	GET /aat?pid=890f9a2a-f5c2-415f-82e9-09a1f0694ac9&event=PageView&ts=1714151699211 HTTP/1.1 Host: ara.paa-reporting-advertising.amazon Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	378	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2 Connection: close Date: Fri, 26 Apr 2024 17:15:02 GMT x-amzn-RequestId: 2a5dbcbc-d7d3-4f14-b059-cc20814da269 X-Cache: Miss from cloudfront Via: 1.1 0e29dbf2290a532921c8437d0713b55c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P7 X-Amz-Cf-Id: rR0lJeSM0lw51-N0-xM3JrS3ZNOKp-LwgnTRnWupAxmoc1wjY5m2-A==
2024-04-26 17:15:02 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.5	50790	13.226.52.120	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	549	OUT	GET /browser-perf.8417c6bba72228fa2e29.js HTTP/1.1 Host: script.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	717	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 5259 Connection: close Date: Wed, 24 Jan 2024 14:32:41 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "fb9f7dae39619642ed5890e40763ef2e" Last-Modified: Wed, 24 Jan 2024 14:31:37 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 813798c6f06431d5dd58aa438e312b3e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 X-Amz-Cf-Id: QWrNASaEMxtpmDVZ4z67ZSVSxLa-brIA8mgPU3NhbaVF50c35o6KKg== Age: 8044941
2024-04-26 17:15:02 UTC	5259	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 65 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 2c 65 28 74 29 7d Data Ascii: !function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
742	192.168.2.5	50789	192.184.68.149	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	1155	OUT	GET /pixel;r=1021613849;labels=_fp.event.Default;rf=0;a=p-W92Yh-Yvb160e;url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=0;fpa=P0-32976898-1714151591136;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=xero.com;dst=1;et=1714151699215;tzo=-120;ogl=type.website%2Csite_name.Xero%2Ctitle.Sign%20up%20for%20free%20trial%2Cdescription.Xero%20free%20trial%20for%2030%20days%252E%20Sign%20up%20to%20try%20Xero%20for%20your%20business%20free%20or%20subsc%2Curl.https%3A%2F%2Fwww%252Exero%252Ecom%2Fus%2Fsignup%2F%2Cimage.https%3A%2F%2Fwww%252Exero%252Ecom%2Fcontent%2Fdam%2Fxero%2Fpilot-images%2Fopengraph%2Fopengraph-xero%252Epng;ses=008290c7-0498-4c7a-b8c6-7875d3cba596;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=662be0ae-af1d2-68ed6-a5993; d=EOcBBgHaKw
2024-04-26 17:15:02 UTC	354	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:02 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-04-26 17:15:02 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
743	192.168.2.5	50791	104.244.42.67	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	763	OUT	GET /i/adsct?bci=3&eci=2&event_id=6ba4850f-c278-4ceb-8231-c9c7cffe9a04&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d9a7932e-bfb1-43a7-8440-52cd896842e2&tw_document_href=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nygt4&type=javascript&version=2.3.30 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_7S+IZt2A7AQlLlz5gTikxQ=="
2024-04-26 17:15:02 UTC	401	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 17:15:01 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: a1229daec0b67410 strict-transport-security: max-age=631138519 x-response-time: 81 x-connection-hash: 81189c3ed0509d6a1ae7dc19758cd8fe816b89cce03576dad7dd3f57943b1a27 connection: close
2024-04-26 17:15:02 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
744	192.168.2.5	50792	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	666	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=PageView&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699241&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1714151592759.820300878&cs_est=true&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:15:02 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:15:02 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
745	192.168.2.5	50793	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	658	OUT	GET /tr/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699244&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&up=hostname&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:02 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=125, rtx=0, c=10, mss=1277, tbw=3403, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:15:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
746	192.168.2.5	50794	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:02 UTC	695	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=referrerSource&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&rl=&if=false&ts=1714151699244&cd[utm_source]=organic&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151696734&coo=false&up=hostname&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:03 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:15:03 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:15:03 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
747	192.168.2.5	50796	142.250.189.132	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:05 UTC	1640	OUT	GET /pagead/1p-conversion/1023673485/?random=191313852&cv=11&fst=1714151696676&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABShV0cmlnZ2VyLCBldmVudC1zb3VyY2ViBAoCAgM&pscrd=CKfs3PafwuGvrQEiEwis0OLZsOCFAxUcioMIHZmGCg0yAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtq-z46BHEBJqzSZuUjl6UwD_3zsUMh2mhV6x_EvsxzDa29jfRs&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaD3zKCHHe3cfByIrQnJcqIx7j-_KL6rMLw&random=677567455 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:05 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:05 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:05 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
748	192.168.2.5	50797	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:05 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: 0E66zLbFyWO2cuBTd0pdCg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:06 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:06 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
749	192.168.2.5	50801	142.250.64.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:06 UTC	843	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le6fDsoAAAAABLpuIc7lmLNZEa2f-gLLKbb4bnV&co=aHR0cHM6Ly93d3cueGVyby5jb206NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=j80nlnbc54q7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:06 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Fri, 26 Apr 2024 17:15:06 GMT Date: Fri, 26 Apr 2024 17:15:06 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:15:06 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js');
2024-04-26 17:15:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
750	192.168.2.5	50799	142.250.64.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:06 UTC	831	OUT	GET /js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le6fDsoAAAAABLpuIc7lmLNZEa2f-gLLKbb4bnV&co=aHR0cHM6Ly93d3cueGVyby5jb206NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=j80nlnbc54q7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:06 UTC	811	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18268 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 25 Apr 2024 17:40:07 GMT Expires: Fri, 25 Apr 2025 17:40:07 GMT Cache-Control: public, max-age=31536000 Age: 84899 Last-Modified: Tue, 16 Apr 2024 13:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:06 UTC	444	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 66 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 69 66 28 21 28 4e 3d 28 52 3d 65 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 52 29 7c 7c 21 52 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 4e 3b 74 72 79 7b 4e 3d 52 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 70 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 70 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 70 7d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var f=function(R,N){if(!(N=(R=e.trustedTypes,null),R)\|\|!R.createPolicy)return N;try{N=R.createPolicy("bg",{createHTML:p,createScript:p,createScriptURL:p}
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 65 61 74 65 53 63 72 69 70 74 28 50 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 50 29 7b 72 65 74 75 72 6e 22 22 2b 50 7d 7d 28 65 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 52 65 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 72 65 74 75 72 6e 20 52 5b 4e 5d 3c 3c 32 34 7c 52 5b 28 4e 7c 30 29 2b 31 5d 3c 3c 31 36 7c 52 5b 28 4e 7c 30 29 2b 32 5d 3c 3c 38 7c 52 5b 28 4e 7c 30 29 2b 33 5d 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 69 66 28 34 33 38 3d Data Ascii: eateScript(P)}:function(P){return""+P}}(e)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','*/','var Re=function(R,N){return R[N]<<24\|R[(N\|0)+1]<<16\|R[(N\|0)+2]<<8\|R[(N\|0)+3]},d=function(R,N,p){if(438=
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 67 5b 77 5d 2c 52 29 3b 72 65 74 75 72 6e 20 4e 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 66 6f 72 28 4e 3d 5b 5d 3b 52 2d 2d 3b 29 4e 2e 70 75 73 68 28 32 35 35 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 3b 72 65 74 75 72 6e 20 4e 7d 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 4e 3d 4e 2e 58 5b 52 5d 2c 4e 29 29 74 68 72 6f 77 5b 4d 2c 33 30 2c 52 5d 3b 69 66 28 4e 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 4e 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 28 4e 2e 63 72 65 61 74 65 28 33 2a 52 2a 52 2b 32 31 2a 52 2b 2d 33 34 29 2c 4e 29 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 50 52 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 2c 77 2c 54 2c 6b 2c 50 29 7b 72 65 74 75 72 6e 20 50 3d 28 Data Ascii: g[w],R);return N},c=function(R,N){for(N=[];R--;)N.push(255Math.random()\|0);return N},Z=function(R,N){if(void 0===(N=N.X[R],N))throw[M,30,R];if(N.value)return N.create();return(N.create(3RR+21R+-34),N).prototype},PR=function(R,N,p,e,w,T,k,P){return P=(
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 2e 67 69 3d 66 2c 32 5d 5d 2c 66 29 3c 3c 33 29 2d 34 3b 74 72 79 7b 54 2e 63 4f 3d 74 41 28 52 65 28 54 2c 28 66 7c 30 29 2b 34 29 2c 52 65 28 54 2c 66 29 2c 79 29 7d 63 61 74 63 68 28 61 29 7b 74 68 72 6f 77 20 61 3b 7d 7d 54 2e 70 75 73 68 28 54 2e 63 4f 5b 50 26 37 5d 5e 6b 29 7d 2c 77 3d 5a 28 35 39 2c 4e 29 29 3a 52 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 54 2e 70 75 73 68 28 6b 29 7d 2c 65 26 26 52 28 65 26 32 35 35 29 2c 4e 3d 70 2e 6c 65 6e 67 74 68 2c 65 3d 30 3b 65 3c 4e 3b 65 2b 2b 29 52 28 70 5b 65 5d 29 7d 2c 45 2c 56 30 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 28 70 3d 74 79 70 65 6f 66 20 52 2c 70 29 29 69 66 28 52 29 7b 69 66 28 52 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 72 65 Data Ascii: .gi=f,2]],f)<<3)-4;try{T.cO=tA(Re(T,(f\|0)+4),Re(T,f),y)}catch(a){throw a;}}T.push(T.cO[P&7]^k)},w=Z(59,N)):R=function(k){T.push(k)},e&&R(e&255),N=p.length,e=0;e<N;e++)R(p[e])},E,V0=function(R,N,p){if("object"==(p=typeof R,p))if(R){if(R instanceof Array)re
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 37 2c 28 4b 28 33 33 36 2c 52 2c 28 4b 28 34 38 35 2c 28 4b 28 28 64 28 35 35 2c 52 2c 28 4b 28 28 64 28 28 64 28 35 30 33 2c 52 2c 28 4b 28 31 32 37 2c 28 64 28 32 39 38 2c 52 2c 63 28 28 4b 28 34 31 38 2c 52 2c 28 4b 28 33 37 2c 52 2c 28 64 28 28 64 28 33 30 31 2c 52 2c 28 64 28 31 36 37 2c 28 4b 28 28 64 28 35 39 2c 52 2c 5b 30 2c 28 4b 28 31 37 31 2c 52 2c 28 4b 28 32 35 2c 28 4b 28 31 31 37 2c 28 4b 28 31 35 33 2c 52 2c 28 64 28 31 36 33 2c 52 2c 28 64 28 33 33 31 2c 28 64 28 34 33 38 2c 52 2c 28 52 2e 61 79 3d 28 4e 3d 28 28 52 2e 57 4f 3d 32 35 2c 52 29 2e 53 3d 28 52 2e 50 3d 5b 5d 2c 28 52 2e 54 3d 28 52 2e 6a 3d 66 61 6c 73 65 2c 52 29 2c 52 29 2e 4c 43 3d 30 2c 52 2e 5a 3d 28 28 28 28 52 2e 73 3d 30 2c 52 2e 59 3d 76 6f 69 64 20 30 2c 52 2e 42 Data Ascii: 7,(K(336,R,(K(485,(K((d(55,R,(K((d((d(503,R,(K(127,(d(298,R,c((K(418,R,(K(37,R,(d((d(301,R,(d(167,(K((d(59,R,[0,(K(171,R,(K(25,(K(117,(K(153,R,(d(163,R,(d(331,(d(438,R,(R.ay=(N=((R.WO=25,R).S=(R.P=[],(R.T=(R.j=false,R),R).LC=0,R.Z=((((R.s=0,R.Y=void 0,R.B
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 64 28 28 66 3d 28 61 3d 56 28 28 79 3d 56 28 50 29 2c 50 29 29 2c 56 29 28 50 29 2c 66 29 2c 50 2c 5a 28 79 2c 50 29 7c 7c 5a 28 61 2c 50 29 29 7d 29 2c 39 34 31 29 29 2c 34 34 29 2c 52 2c 72 29 2c 31 37 29 2c 52 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 21 58 28 66 2c 74 72 75 65 2c 66 61 6c 73 65 2c 50 29 26 26 28 66 3d 54 32 28 50 29 2c 61 3d 66 2e 73 52 2c 79 3d 66 2e 6e 43 2c 50 2e 54 3d 3d 50 7c 7c 61 3d 3d 50 2e 5a 55 26 26 79 3d 3d 50 29 26 26 28 64 28 66 2e 7a 73 2c 50 2c 61 2e 61 70 70 6c 79 28 79 2c 66 2e 67 29 29 2c 50 2e 41 3d 50 2e 4e 28 29 29 7d 29 2c 30 29 29 2c 35 30 38 29 2c 52 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 2c 74 2c 47 2c 53 2c 43 2c 62 2c 42 2c 59 Data Ascii: function(P,f,y,a){d((f=(a=V((y=V(P),P)),V)(P),f),P,Z(y,P)\|\|Z(a,P))}),941)),44),R,r),17),R,function(P,f,y,a){!X(f,true,false,P)&&(f=T2(P),a=f.sR,y=f.nC,P.T==P\|\|a==P.ZU&&y==P)&&(d(f.zs,P,a.apply(y,f.g)),P.A=P.N())}),0)),508),R,function(P,f,y,a,t,G,S,C,b,B,Y
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 29 2c 50 29 29 2c 56 29 28 50 29 2c 5a 28 66 2c 50 29 29 2c 74 29 2c 50 29 2c 5a 28 53 2c 50 29 29 2c 79 3d 5a 28 79 2c 50 29 2c 53 29 29 29 7b 66 6f 72 28 61 20 69 6e 20 47 3d 5b 5d 2c 53 29 47 2e 70 75 73 68 28 61 29 3b 53 3d 47 7d 69 66 28 50 2e 54 3d 3d 50 29 66 6f 72 28 66 3d 30 3c 66 3f 66 3a 31 2c 50 3d 53 2e 6c 65 6e 67 74 68 2c 61 3d 30 3b 61 3c 50 3b 61 2b 3d 66 29 74 28 53 2e 73 6c 69 63 65 28 61 2c 28 61 7c 30 29 2b 28 66 7c 30 29 29 2c 79 29 7d 7d 29 2c 52 29 2e 48 4f 3d 30 2c 52 29 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 28 61 3d 56 28 28 79 3d 28 66 3d 56 28 50 29 2c 56 28 50 29 29 2c 50 29 29 2c 50 2e 54 3d 3d 50 29 26 26 28 79 3d 5a 28 79 2c 50 29 2c 61 3d 5a 28 61 2c 50 29 2c 5a 28 66 2c 50 29 5b 79 5d 3d 61 2c 32 34 37 Data Ascii: ),P)),V)(P),Z(f,P)),t),P),Z(S,P)),y=Z(y,P),S))){for(a in G=[],S)G.push(a);S=G}if(P.T==P)for(f=0<f?f:1,P=S.length,a=0;a<P;a+=f)t(S.slice(a,(a\|0)+(f\|0)),y)}}),R).HO=0,R),function(P,f,y,a){(a=V((y=(f=V(P),V(P)),P)),P.T==P)&&(y=Z(y,P),a=Z(a,P),Z(f,P)[y]=a,247
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 6e 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 7d 2c 28 52 28 66 75 6e 63 74 69 6f 6e 28 70 29 7b 70 28 4e 29 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 5d 7d 2c 72 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 49 65 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 29 7b 72 65 74 75 72 6e 20 5a 28 28 64 28 34 33 38 2c 52 2c 28 46 79 28 4e 2c 28 28 65 3d 5a 28 34 33 38 2c 52 29 2c 52 2e 50 29 26 26 65 3c 52 2e 73 3f 28 64 28 34 33 38 2c 52 2c 52 2e 73 29 2c 5a 65 28 52 2c 70 29 29 3a 64 28 34 33 38 2c 52 2c 70 29 2c 52 29 29 2c 65 29 29 2c 32 36 31 29 2c 52 29 7d 2c 4e 5f 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 72 65 74 75 72 6e 28 70 3d 6c 5b 4e 2e 57 5d 28 4e 2e 4f 52 29 2c 70 5b 4e 2e 57 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 Data Ascii: n[function(){return N},(R(function(p){p(N)}),function(){})]},r=this\|\|self,Ie=function(R,N,p,e){return Z((d(438,R,(Fy(N,((e=Z(438,R),R.P)&&e<R.s?(d(438,R,R.s),Ze(R,p)):d(438,R,p),R)),e)),261),R)},N_=function(R,N,p){return(p=l[N.W](N.OR),p[N.W]=function(){r
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 4e 5d 7c 30 29 2d 28 52 5b 28 28 4e 7c 30 29 2b 31 29 25 33 5d 7c 30 29 2d 28 65 7c 30 29 5e 28 31 3d 3d 4e 3f 65 3c 3c 70 3a 65 3e 3e 3e 70 29 7d 63 61 74 63 68 28 77 29 7b 74 68 72 6f 77 20 77 3b 7d 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 2c 77 2c 54 29 7b 69 66 28 21 70 2e 72 69 26 26 28 54 3d 76 6f 69 64 20 30 2c 4e 26 26 4e 5b 30 5d 3d 3d 3d 4d 26 26 28 54 3d 4e 5b 32 5d 2c 52 3d 4e 5b 31 5d 2c 4e 3d 76 6f 69 64 20 30 29 2c 65 3d 5a 28 31 37 32 2c 70 29 2c 30 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 28 77 3d 5a 28 33 33 31 2c 70 29 3e 3e 33 2c 65 2e 70 75 73 68 28 52 2c 77 3e 3e 38 26 32 35 35 2c 77 26 32 35 35 29 2c 76 6f 69 64 20 30 21 3d 54 26 26 65 2e 70 75 73 68 28 54 26 32 35 35 29 29 2c 52 3d 22 22 2c 4e 26 26 28 4e 2e 6d 65 73 Data Ascii: N]\|0)-(R[((N\|0)+1)%3]\|0)-(e\|0)^(1==N?e<<p:e>>>p)}catch(w){throw w;}},n=function(R,N,p,e,w,T){if(!p.ri&&(T=void 0,N&&N[0]===M&&(T=N[2],R=N[1],N=void 0),e=Z(172,p),0==e.length&&(w=Z(331,p)>>3,e.push(R,w>>8&255,w&255),void 0!=T&&e.push(T&255)),R="",N&&(N.mes
2024-04-26 17:15:06 UTC	1255	IN	Data Raw: 2e 41 3d 54 3b 69 66 28 21 6b 7c 7c 54 2d 65 2e 43 3c 65 2e 42 4f 2d 28 70 3f 32 35 35 3a 4e 3f 35 3a 32 29 29 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 72 65 74 75 72 6e 20 65 2e 5a 3d 28 64 28 34 33 38 2c 28 70 3d 5a 28 28 65 2e 74 54 3d 52 2c 4e 29 3f 33 33 31 3a 34 33 38 2c 65 29 2c 65 29 2c 65 2e 73 29 2c 65 2e 56 2e 70 75 73 68 28 5b 69 47 2c 70 2c 4e 3f 52 2b 31 3a 52 2c 65 2e 44 2c 65 2e 6a 2c 65 2e 76 2c 65 2e 69 5d 29 2c 44 65 29 2c 74 72 75 65 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 4e 2e 42 3d 28 28 4e 2e 42 3f 4e 2e 42 2b 22 7e 22 3a 22 45 3a 22 29 2b 52 2e 6d 65 73 73 61 67 65 2b 22 3a 22 2b 52 2e 73 74 61 63 6b 29 2e 73 6c 69 63 65 28 30 2c 32 30 34 38 29 7d 2c 44 65 3d 72 2e 72 65 71 75 65 73 74 49 64 6c 65 43 61 6c 6c 62 61 63 Data Ascii: .A=T;if(!k\|\|T-e.C<e.BO-(p?255:N?5:2))return false;return e.Z=(d(438,(p=Z((e.tT=R,N)?331:438,e),e),e.s),e.V.push([iG,p,N?R+1:R,e.D,e.j,e.v,e.i]),De),true},H=function(R,N){N.B=((N.B?N.B+"~":"E:")+R.message+":"+R.stack).slice(0,2048)},De=r.requestIdleCallbac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
751	192.168.2.5	50798	54.229.161.54	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:06 UTC	624	OUT	POST /?v=6&site_id=3197823 HTTP/1.1 Host: metrics.hotjar.io Connection: keep-alive Content-Length: 598 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:06 UTC	598	OUT	Data Raw: 5b 7b 22 6e 61 6d 65 22 3a 22 74 61 73 6b 2d 65 78 65 63 75 74 69 6f 6e 2d 74 69 6d 65 22 2c 22 74 79 70 65 22 3a 22 64 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 76 61 6c 75 65 22 3a 31 35 36 2c 22 74 61 67 73 22 3a 7b 22 74 61 73 6b 22 3a 22 6e 6f 64 65 2d 73 75 70 70 72 65 73 73 69 6f 6e 22 7d 7d 2c 7b 22 6e 61 6d 65 22 3a 22 74 61 73 6b 2d 65 78 65 63 75 74 69 6f 6e 2d 74 69 6d 65 22 2c 22 74 79 70 65 22 3a 22 64 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 76 61 6c 75 65 22 3a 31 36 34 2c 22 74 61 67 73 22 3a 7b 22 74 61 73 6b 22 3a 22 64 6f 6d 2d 73 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2d 61 73 79 6e 63 22 7d 7d 2c 7b 22 6e 61 6d 65 22 3a 22 70 63 2d 63 6f 6d 70 72 65 73 73 69 6f 6e 2d 74 69 6d 65 22 2c 22 74 79 70 65 22 3a 22 64 69 73 74 72 69 62 75 74 Data Ascii: [{"name":"task-execution-time","type":"distribution","value":156,"tags":{"task":"node-suppression"}},{"name":"task-execution-time","type":"distribution","value":164,"tags":{"task":"dom-serialization-async"}},{"name":"pc-compression-time","type":"distribut
2024-04-26 17:15:06 UTC	146	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:15:06 GMT Connection: close Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
752	192.168.2.5	50803	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:06 UTC	1350	OUT	GET /js_tracking?url=https%3A%2F%2Fwww.xero.com%2Fus%2F&uid=XVsUfradtXcBUl5XS45ldg&v=1&host=https%3A%2F%2Fwww.xero.com HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:06 UTC	242	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:15:06 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
753	192.168.2.5	50805	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:06 UTC	951	OUT	GET /ddm/fls/z/dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:06 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:06 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:06 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
754	192.168.2.5	50806	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:06 UTC	1408	OUT	GET /pagead/1p-conversion/1023673485/?random=191313852&cv=11&fst=1714151696676&bg=ffffff&guid=ON&async=1&gtm=45be44o0v883646161z8830923470za201&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&label=v0RbCOHw2eECEI2JkOgD&hn=www.googleadservices.com&frm=0&tiba=Sign%20up%20for%20free%20trial%20%7C%20Xero%20US&value=0&npa=0&pscdl=noapi&auid=2064983717.1714151587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQE4AUABShV0cmlnZ2VyLCBldmVudC1zb3VyY2ViBAoCAgM&pscrd=CKfs3PafwuGvrQEiEwis0OLZsOCFAxUcioMIHZmGCg0yAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzoVaHR0cHM6Ly93d3cueGVyby5jb20v&is_vtc=1&cid=CAQSKQB7FLtq-z46BHEBJqzSZuUjl6UwD_3zsUMh2mhV6x_EvsxzDa29jfRs&eitems=ChAI8KGtsQYQp_eB6IzamK4VEh0AuQFbaD3zKCHHe3cfByIrQnJcqIx7j-_KL6rMLw&random=677567455 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:06 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:06 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:06 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
755	192.168.2.5	50809	142.250.64.196	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:07 UTC	867	OUT	GET /recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:07 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 17:15:07 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-c-HHWGexH5_9cnR1S1pDwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:15:07 UTC	364	IN	Data Raw: 31 64 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-04-26 17:15:07 UTC	1255	IN	Data Raw: 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e Data Ascii: v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fon
2024-04-26 17:15:07 UTC	1255	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E0
2024-04-26 17:15:07 UTC	1255	IN	Data Raw: 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b Data Ascii: U+04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-26 17:15:07 UTC	1255	IN	Data Raw: 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b Data Ascii: ce { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+
2024-04-26 17:15:07 UTC	1255	IN	Data Raw: 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: tic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight
2024-04-26 17:15:07 UTC	813	IN	Data Raw: 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 63 2d 48 48 57 47 65 78 48 35 5f 39 63 6e 52 31 53 31 70 44 77 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: }</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css"><script nonce="c-HHWGexH5_9cnR1S1pDwA" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.co
2024-04-26 17:15:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
756	192.168.2.5	50815	18.210.82.4	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:09 UTC	1359	OUT	GET /js_tracking?url=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&uid=XVsUfradtXcBUl5XS45ldg&v=1&host=https%3A%2F%2Fwww.xero.com HTTP/1.1 Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:09 UTC	242	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:15:09 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
757	192.168.2.5	50812	15.197.193.217	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:09 UTC	1487	OUT	GET /track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/signup/ HTTP/1.1 Host: insight.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFGAUgASgDMgsI9s7y5OOH8zwQBTgBQgQiAggBWgc5bmxyeDhwYAE.
2024-04-26 17:15:09 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:09 GMT Content-Type: text/html Content-Length: 877 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:15:09 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFEhYKB3gyZTd0cTgSCwi8gOvUzofzPBAFEhsKDHNoYXJldGhyb3VnaBILCNC969TOh_M8EAUSGAoJY3Jvc3N3aXNlEgsI2PXr1M6H8zwQBRgFKAMyCwjalu2B5YfzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..; expires=Sat, 26 Apr 2025 17:15:09 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:15:09 UTC	877	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 61 64 73 72 76 72 2e 6f 72 67 2f 75 6e 69 76 65 72 73 61 6c 5f 70 69 78 65 6c 2e 31 2e 31 2e 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 75 6e 69 76 65 72 73 61 6c 50 69 78 65 6c 43 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 6c 6f 62 61 6c 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <html><head> <script type="text/javascript" src="https://js.adsrvr.org/universal_pixel.1.1.0.js"></script></head><body> <div id="universalPixelContainer"> <script type="text/javascript"> (function(global) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
758	192.168.2.5	50818	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:09 UTC	1100	OUT	POST /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=16426&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/&af=err,xhr,stn,ins,spa&be=592&fe=14189&dc=588&perf=%7B%22timing%22:%7B%22of%22:1714151691734,%22n%22:0,%22f%22:3,%22dn%22:42,%22dne%22:42,%22c%22:42,%22s%22:42,%22ce%22:301,%22rq%22:301,%22rp%22:592,%22rpe%22:1063,%22di%22:1138,%22ds%22:1179,%22de%22:1179,%22dc%22:14756,%22l%22:14757,%22le%22:14780%7D,%22navigation%22:%7B%7D%7D&fp=970&fcp=970 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 28 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:09 UTC	28	OUT	Data Raw: 7b 22 6a 61 22 3a 7b 22 73 69 74 65 56 65 72 73 69 6f 6e 22 3a 22 6e 65 77 22 7d 7d Data Ascii: {"ja":{"siteVersion":"new"}}
2024-04-26 17:15:09 UTC	436	IN	HTTP/1.1 200 Connection: close Content-Length: 151 date: Fri, 26 Apr 2024 17:15:09 GMT content-type: text/plain cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com access-control-expose-headers: Date timing-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760038-MIA
2024-04-26 17:15:09 UTC	151	IN	Data Raw: 7b 22 73 74 6e 22 3a 30 2c 22 65 72 72 22 3a 31 2c 22 69 6e 73 22 3a 31 2c 22 73 70 61 22 3a 31 2c 22 73 72 22 3a 30 2c 22 73 72 73 22 3a 30 2c 22 73 74 22 3a 30 2c 22 73 74 73 22 3a 30 2c 22 61 70 70 22 3a 7b 22 61 67 65 6e 74 73 22 3a 5b 7b 22 65 6e 74 69 74 79 47 75 69 64 22 3a 22 4d 54 6b 32 4d 6a 41 78 4e 33 78 43 55 6b 39 58 55 30 56 53 66 45 46 51 55 45 78 4a 51 30 46 55 53 55 39 4f 66 44 45 77 4d 6a 4d 7a 4f 44 55 78 4e 6a 41 22 7d 5d 7d 7d Data Ascii: {"stn":0,"err":1,"ins":1,"spa":1,"sr":0,"srs":0,"st":0,"sts":0,"app":{"agents":[{"entityGuid":"MTk2MjAxN3xCUk9XU0VSfEFQUExJQ0FUSU9OfDEwMjMzODUxNjA"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
759	192.168.2.5	50820	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:09 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: QkUIEqIHyc8P32GMIMmp/Q== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:10 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:10 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
760	192.168.2.5	50825	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:09 UTC	764	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=17009&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1982 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:09 UTC	1982	OUT	Data Raw: 62 65 6c 2e 37 3b 31 2c 71 2c 2c 64 34 63 2c 63 6f 62 2c 31 6a 6c 2c 27 69 6e 69 74 69 61 6c 50 61 67 65 4c 6f 61 64 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 75 73 2f 73 69 67 6e 75 70 2f 2c 31 2c 31 2c 2c 2c 21 21 21 21 27 35 65 35 61 63 61 65 31 2d 33 33 64 36 2d 34 32 65 32 2d 62 36 33 64 2d 35 32 39 62 36 30 63 36 38 62 30 34 2c 27 31 2c 71 79 2c 71 79 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 2c 31 33 33 2c 32 37 2c 31 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 31 31 2c 21 21 21 3b 32 2c 2c 31 30 75 2c 31 68 31 2c 2c 2c 27 50 4f 53 54 2c Data Ascii: bel.7;1,q,,d4c,cob,1jl,'initialPageLoad,'https://www.xero.com/us/signup/,1,1,,,!!!!'5e5acae1-33d6-42e2-b63d-529b60c68b04,'1,qy,qy;5,'siteVersion,'new;2,,133,27,1,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'11,!!!;2,,10u,1h1,,,'POST,
2024-04-26 17:15:10 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:10 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760022-MIA
2024-04-26 17:15:10 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
761	192.168.2.5	50824	50.57.31.206	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:09 UTC	886	OUT	GET /tradedesk/1/get?sType=sync&sExtCookieId=e09cd2aa-7185-40a5-bf74-4fc29b294347&sInitiator=external&_url=https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: SEUNCY=79BF085BEDC69CF5
2024-04-26 17:15:10 UTC	636	IN	HTTP/1.1 302 Found Location: https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm UIP-Response-Status: Ok Frontend-ID: 7 Set-Cookie: SEUNCY=79BF085BEDC69CF5; Expires=Sat, 26 Apr 2025 17:15:10 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Connection: close Date: Fri, 26 Apr 2024 17:15:10 GMT Content-Length: 0 Routing-Server-ID: -1 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
762	192.168.2.5	50821	54.229.161.54	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:10 UTC	623	OUT	POST /?v=6&site_id=3197823 HTTP/1.1 Host: metrics.hotjar.io Connection: keep-alive Content-Length: 94 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:10 UTC	94	OUT	Data Raw: 5b 7b 22 6e 61 6d 65 22 3a 22 73 65 73 73 69 6f 6e 2d 69 6e 74 65 72 72 75 70 74 69 6f 6e 22 2c 22 74 79 70 65 22 3a 22 63 6f 75 6e 74 22 2c 22 76 61 6c 75 65 22 3a 31 2c 22 74 61 67 73 22 3a 7b 22 72 65 61 73 6f 6e 22 3a 22 77 65 62 73 6f 63 6b 65 74 2d 63 6c 6f 73 65 22 7d 7d 5d Data Ascii: [{"name":"session-interruption","type":"count","value":1,"tags":{"reason":"websocket-close"}}]
2024-04-26 17:15:10 UTC	146	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:15:10 GMT Connection: close Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
763	192.168.2.5	50826	52.206.13.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:10 UTC	781	OUT	GET /sync/v1?source_id=5b286190338513af73f09c28&source_user_id=e09cd2aa-7185-40a5-bf74-4fc29b294347 HTTP/1.1 Host: match.sharethrough.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:10 UTC	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:10 GMT Content-Type: image/png Content-Length: 68 Connection: close Set-Cookie: stx_user_id=93830bd2-941f-4d1e-bf0b-013206529851; Max-Age=2592000; Expires=Sun, 26 May 2024 17:15:10 GMT; Path=/; Domain=.sharethrough.com; Secure; SameSite=None Cache-Control: no-cache
2024-04-26 17:15:10 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0b 49 44 41 54 78 da 63 f8 ff 1f 00 03 00 01 ff 6f 81 ab b6 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxcoIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
764	192.168.2.5	50828	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:10 UTC	816	OUT	GET /pixel?google_nid=semasio_ddp&google_cm HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:11 UTC	708	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEO6pjxdnwkaUlkGBLOOtw0U&sInitiator=internal&google_cver=1&google_cver=1 Date: Fri, 26 Apr 2024 17:15:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 Server: HTTP server (unknown) Content-Length: 351 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:11 UTC	351	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 75 69 70 67 6c 6f 62 2e 73 65 6d 61 73 69 6f 2e 6e 65 74 2f 64 62 6d 2f 31 2f 69 6e 66 6f 3f 73 54 79 70 65 3d 73 79 6e 63 26 61 6d 70 3b 73 45 78 74 43 6f 6f 6b 69 65 49 64 3d 43 41 45 53 45 4f 36 70 6a 78 64 6e 77 6b 61 55 6c 6b 47 42 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEO6pjxdnwkaUlkGB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
765	192.168.2.5	50830	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:10 UTC	397	OUT	OPTIONS /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Origin: https://alb.reddit.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:11 UTC	644	IN	HTTP/1.1 204 No Content Connection: close Server: Varnish Retry-After: 0 Access-Control-Allow-Origin: https://alb.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:15:11 GMT Via: 1.1 varnish Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
766	192.168.2.5	50831	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:10 UTC	397	OUT	OPTIONS /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Origin: https://alb.reddit.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:11 UTC	644	IN	HTTP/1.1 204 No Content Connection: close Server: Varnish Retry-After: 0 Access-Control-Allow-Origin: https://alb.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:15:11 GMT Via: 1.1 varnish Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
767	192.168.2.5	50829	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:11 UTC	1503	OUT	GET /track/cmf/generic?ttd_pid=crosswise HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFEhYKB3gyZTd0cTgSCwi8gOvUzofzPBAFEhsKDHNoYXJldGhyb3VnaBILCNC969TOh_M8EAUSGAoJY3Jvc3N3aXNlEgsI2PXr1M6H8zwQBRgFKAMyCwjalu2B5YfzPBAFOAFCBCICCAFaBzlubHJ4OHBgAQ..
2024-04-26 17:15:11 UTC	1120	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:11 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:15:11 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFEhYKB3gyZTd0cTgSCwi8gOvUzofzPBAFEhsKDHNoYXJldGhyb3VnaBILCNC969TOh_M8EAUSGAoJY3Jvc3N3aXNlEgsI2PXr1M6H8zwQBRgFIAEoAzILCNqW7YHlh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB; expires=Sat, 26 Apr 2025 17:15:11 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:15:11 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
768	192.168.2.5	50832	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:11 UTC	341	OUT	POST /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Content-Length: 1485 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:11 UTC	1485	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 38 31 38 37 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 39 30 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 33 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 35 31 2e 31 30 31 2e 31 39 33 2e 31 34 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: [{"age":18187,"body":{"elapsed_time":907,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://www.xero.com/","sampling_fraction":0.3,"server_ip":"151.101.193.140","status_code":200,"type":"ok"},"type":"network-error","url":"https
2024-04-26 17:15:11 UTC	681	IN	HTTP/1.1 200 OK Connection: close Content-Length: 0 content-type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:15:11 GMT Via: 1.1 varnish Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block server: snooserv Access-Control-Allow-Origin: https://www.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
769	192.168.2.5	50834	151.101.1.140	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:11 UTC	340	OUT	POST /reports HTTP/1.1 Host: w3-reporting-nel.reddit.com Connection: keep-alive Content-Length: 722 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:11 UTC	722	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 36 33 30 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 38 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 33 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 35 31 2e 31 30 31 2e 31 32 39 2e 31 34 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6c 62 2e 72 65 64 64 69 74 2e 63 6f 6d 2f 72 70 2e Data Ascii: [{"age":46302,"body":{"elapsed_time":680,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":0.3,"server_ip":"151.101.129.140","status_code":200,"type":"ok"},"type":"network-error","url":"https://alb.reddit.com/rp.
2024-04-26 17:15:11 UTC	681	IN	HTTP/1.1 200 OK Connection: close Content-Length: 0 content-type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Fri, 26 Apr 2024 17:15:11 GMT Via: 1.1 varnish Strict-Transport-Security: max-age=31536000; includeSubdomains X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block server: snooserv Access-Control-Allow-Origin: https://www.reddit.com Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,X-origination-host,X-origination-path Access-Control-Expose-Headers: * Access-Control-Max-Age: 86400 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
770	192.168.2.5	50836	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:11 UTC	855	OUT	GET /1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=16426&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/&af=err,xhr,stn,ins,spa&be=592&fe=14189&dc=588&perf=%7B%22timing%22:%7B%22of%22:1714151691734,%22n%22:0,%22f%22:3,%22dn%22:42,%22dne%22:42,%22c%22:42,%22s%22:42,%22ce%22:301,%22rq%22:301,%22rp%22:592,%22rpe%22:1063,%22di%22:1138,%22ds%22:1179,%22de%22:1179,%22dc%22:14756,%22l%22:14757,%22le%22:14780%7D,%22navigation%22:%7B%7D%7D&fp=970&fcp=970 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:11 UTC	396	IN	HTTP/1.1 200 Connection: close Content-Length: 79 date: Fri, 26 Apr 2024 17:15:11 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Date timing-allow-origin: * x-served-by: cache-mia-kmia1760048-MIA
2024-04-26 17:15:11 UTC	79	IN	Data Raw: 5b 37 31 2c 20 37 33 2c 20 37 30 2c 20 35 36 2c 20 35 37 2c 20 39 37 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 34 34 2c 20 30 2c 20 30 2c 20 30 2c 20 30 2c 20 31 2c 20 30 2c 20 31 2c 20 30 2c 20 30 2c 20 32 5d Data Ascii: [71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
771	192.168.2.5	50833	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:11 UTC	758	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26064&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 261 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:11 UTC	261	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 5f 74 72 61 63 6b 69 6e 67 22 2c 22 73 74 61 74 75 73 22 3a 32 30 34 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 37 39 37 7d 2c 22 63 62 54 69 6d 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 74 69 6d 65 22 3a 7b 22 74 22 3a 32 30 38 35 Data Ascii: {"xhr":[{"params":{"method":"GET","hostname":"tags.srv.stackadapt.com","port":"443","protocol":"https","host":"tags.srv.stackadapt.com:443","pathname":"/js_tracking","status":204},"metrics":{"count":1,"duration":{"t":797},"cbTime":{"t":0},"time":{"t":2085
2024-04-26 17:15:11 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:11 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760048-MIA
2024-04-26 17:15:11 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
772	192.168.2.5	50835	50.57.31.206	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:11 UTC	827	OUT	GET /dbm/1/info?sType=sync&sExtCookieId=CAESEO6pjxdnwkaUlkGBLOOtw0U&sInitiator=internal&google_cver=1&google_cver=1 HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: SEUNCY=79BF085BEDC69CF5
2024-04-26 17:15:11 UTC	627	IN	HTTP/1.1 302 Found Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8 UIP-Response-Status: Ok Frontend-ID: 7 Set-Cookie: SEUNCY=79BF085BEDC69CF5; Expires=Sat, 26 Apr 2025 17:15:11 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Connection: close Date: Fri, 26 Apr 2024 17:15:11 GMT Content-Length: 0 Routing-Server-ID: -1 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
773	192.168.2.5	50838	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:12 UTC	517	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=17009&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:12 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:12 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760061-MIA
2024-04-26 17:15:12 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
774	192.168.2.5	50837	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:12 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: iDVC5mM/ggXTgxGIgIqmLQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:13 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:13 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
775	192.168.2.5	50840	52.223.40.198	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:14 UTC	1501	OUT	GET /track/cmf/generic?ttd_pid=x2e7tq8 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://insight.adsrvr.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFEhYKB3gyZTd0cTgSCwi8gOvUzofzPBAFEhsKDHNoYXJldGhyb3VnaBILCNC969TOh_M8EAUSGAoJY3Jvc3N3aXNlEgsI2PXr1M6H8zwQBRgFIAEoAzILCNqW7YHlh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB
2024-04-26 17:15:14 UTC	1120	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:14 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel set-cookie: TDID=e09cd2aa-7185-40a5-bf74-4fc29b294347; expires=Sat, 26 Apr 2025 17:15:14 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsImrDA1saH8zwQBRIVCgZnb29nbGUSCwiSw57txofzPBAFEhYKB2JsdWVrYWkSCwiK7cDWxofzPBAFEhcKCGFwcG5leHVzEgsItvqLrsiH8zwQBRIWCgdydWJpY29uEgsIzL_ykciH8zwQBRIUCgV0YXBhZBILCKrk8pHIh_M8EAUSFQoGY2FzYWxlEgsIgvrTl8mH8zwQBRIYCglhZGFkdmlzb3ISCwiKntSXyYfzPBAFEhYKB2xod2JrNTkSCwjWwNSXyYfzPBAFEhYKB2FkZHRoaXMSCwiegJ_Ey4fzPBAFEhYKB3lqbjBndXASCwjMq5_Ey4fzPBAFEhYKB3VlZDNrdnISCwiE2J_Ey4fzPBAFEhYKBzFpMDcxbmMSCwjukuHkzIfzPBAFEhYKB3NlbWFzaW8SCwjwvOHkzIfzPBAFEhYKB3ZjeGx6a3oSCwjk5eHkzIfzPBAFEhYKBzRoM3luMWYSCwiAlfC3zYfzPBAFEhYKB2QwdHJvMWoSCwjszPC3zYfzPBAFEhYKB3N2eDl0NTASCwjM_PC3zYfzPBAFEhYKB3gyZTd0cTgSCwi8gOvUzofzPBAFEhsKDHNoYXJldGhyb3VnaBILCNC969TOh_M8EAUSGAoJY3Jvc3N3aXNlEgsI2PXr1M6H8zwQBRgFIAIoAzILCNqW7YHlh_M8EAU4AUIEIgIIAVoHOW5scng4cGAB; expires=Sat, 26 Apr 2025 17:15:14 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-04-26 17:15:14 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
776	192.168.2.5	50841	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:14 UTC	512	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26064&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:14 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:14 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760034-MIA
2024-04-26 17:15:14 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
777	192.168.2.5	50843	54.229.161.54	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:17 UTC	623	OUT	POST /?v=6&site_id=3197823 HTTP/1.1 Host: metrics.hotjar.io Connection: keep-alive Content-Length: 94 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:17 UTC	94	OUT	Data Raw: 5b 7b 22 6e 61 6d 65 22 3a 22 73 65 73 73 69 6f 6e 2d 69 6e 74 65 72 72 75 70 74 69 6f 6e 22 2c 22 74 79 70 65 22 3a 22 63 6f 75 6e 74 22 2c 22 76 61 6c 75 65 22 3a 31 2c 22 74 61 67 73 22 3a 7b 22 72 65 61 73 6f 6e 22 3a 22 77 65 62 73 6f 63 6b 65 74 2d 63 6c 6f 73 65 22 7d 7d 5d Data Ascii: [{"name":"session-interruption","type":"count","value":1,"tags":{"reason":"websocket-close"}}]
2024-04-26 17:15:17 UTC	146	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:15:17 GMT Connection: close Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
778	192.168.2.5	50844	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:19 UTC	763	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26994&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 151 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:19 UTC	151	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 66 70 2c 71 79 2c 31 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 65 2c 27 66 63 70 2c 71 79 2c 31 3b 35 2c 31 2c 32 3b 65 2c 27 70 61 67 65 48 69 64 65 2c 31 39 68 2c 32 3b 36 2c 27 63 6c 73 2c 30 2e 30 31 35 35 31 39 38 30 30 39 37 33 34 32 36 37 33 35 3b 35 2c 31 2c 32 3b 65 2c 27 6c 6f 61 64 2c 62 65 6b 2c 32 3b 36 2c 35 2c 30 2e 30 31 35 35 31 39 38 30 30 39 37 33 34 32 36 37 33 35 3b 35 2c 31 2c 32 Data Ascii: bel.6;e,'fp,qy,1;5,'siteVersion,'new;e,'fcp,qy,1;5,1,2;e,'pageHide,19h,2;6,'cls,0.015519800973426735;5,1,2;e,'load,bek,2;6,5,0.015519800973426735;5,1,2
2024-04-26 17:15:20 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:20 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760051-MIA
2024-04-26 17:15:20 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
779	192.168.2.5	50845	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:19 UTC	766	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26996&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 6956 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:19 UTC	6956	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 33 30 39 39 33 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 37 39 7d 2c Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/_next/data/1712725399/us.json","method":"GET","status":200},"metrics":{"count":1,"txSize":{"t":0},"rxSize":{"t":30993},"duration":{"t":79},
2024-04-26 17:15:20 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:20 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760092-MIA
2024-04-26 17:15:20 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
780	192.168.2.5	50846	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:19 UTC	764	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26999&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1914 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:19 UTC	1914	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 31 33 33 2c 32 37 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 5f 6e 65 78 74 2f 64 61 74 61 2f 31 37 31 32 37 32 35 33 39 39 2f 75 73 2e 6a 73 6f 6e 2c 2c 6e 77 78 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 31 30 75 2c 31 68 31 2c 2c 2c 27 50 4f 53 54 2c 35 6d 2c 31 2c 27 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 2c 64 66 2c 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 31 30 77 2c 31 67 7a 2c 2c 2c 36 2c 35 6b 2c 27 78 65 72 6f 6c 69 6d 69 74 65 64 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 3a 34 34 33 2c 27 2f 72 65 73 74 2f 76 31 2f 64 65 6c 69 76 65 72 79 2c 61 37 2c 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 Data Ascii: bel.7;2,1,133,27,,,'GET,5k,'www.xero.com:443,'/_next/data/1712725399/us.json,,nwx,1,'0,!!!;5,'siteVersion,'new;2,1,10u,1h1,,,'POST,5m,1,'/api/events/v1/,df,,1,3,!!!;5,4,5;2,1,10w,1gz,,,6,5k,'xerolimited.tt.omtrdc.net:443,'/rest/v1/delivery,a7,,1,3,!!!;5,4
2024-04-26 17:15:20 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:20 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760060-MIA
2024-04-26 17:15:20 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
781	192.168.2.5	50848	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:20 UTC	519	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26996&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:20 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:20 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760082-MIA
2024-04-26 17:15:20 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
782	192.168.2.5	50847	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:20 UTC	517	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26994&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:20 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:20 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760069-MIA
2024-04-26 17:15:20 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
783	192.168.2.5	50849	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:20 UTC	517	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=26999&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:20 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:20 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760030-MIA
2024-04-26 17:15:20 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
784	192.168.2.5	50850	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:22 UTC	758	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=37067&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 294 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:22 UTC	294	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 65 72 72 6f 72 73 2f 31 2f 65 31 36 38 61 66 63 37 62 31 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 36 31 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 34 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 33 31 34 39 7d 2c Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/jserrors/1/e168afc7b1","status":200},"metrics":{"count":1,"txSize":{"t":261},"rxSize":{"t":24},"duration":{"t":3149},
2024-04-26 17:15:22 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:22 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760044-MIA
2024-04-26 17:15:22 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
785	192.168.2.5	50851	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:22 UTC	512	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=37067&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:23 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:23 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760051-MIA
2024-04-26 17:15:23 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
786	192.168.2.5	50852	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:24 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: XuuzMgoAchUiYKB98t3vNw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:24 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:24 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
787	192.168.2.5	50853	54.229.161.54	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:28 UTC	623	OUT	POST /?v=6&site_id=3197823 HTTP/1.1 Host: metrics.hotjar.io Connection: keep-alive Content-Length: 94 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:28 UTC	94	OUT	Data Raw: 5b 7b 22 6e 61 6d 65 22 3a 22 73 65 73 73 69 6f 6e 2d 69 6e 74 65 72 72 75 70 74 69 6f 6e 22 2c 22 74 79 70 65 22 3a 22 63 6f 75 6e 74 22 2c 22 76 61 6c 75 65 22 3a 31 2c 22 74 61 67 73 22 3a 7b 22 72 65 61 73 6f 6e 22 3a 22 77 65 62 73 6f 63 6b 65 74 2d 63 6c 6f 73 65 22 7d 7d 5d Data Ascii: [{"name":"session-interruption","type":"count","value":1,"tags":{"reason":"websocket-close"}}]
2024-04-26 17:15:29 UTC	146	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 17:15:28 GMT Connection: close Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
788	192.168.2.5	50854	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:29 UTC	765	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=37007&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 770 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:29 UTC	770	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 65 76 65 6e 74 73 2f 31 2f 65 31 36 38 61 66 63 37 62 31 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 32 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 30 36 35 2c 22 6d 69 6e 22 3a 31 35 31 2c 22 6d 61 78 22 3a 31 39 31 34 2c 22 73 6f 73 22 3a 33 36 38 36 31 39 37 2c 22 63 22 3a 32 7d 2c Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/events/1/e168afc7b1","status":200},"metrics":{"count":2,"txSize":{"t":2065,"min":151,"max":1914,"sos":3686197,"c":2},
2024-04-26 17:15:30 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:30 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760069-MIA
2024-04-26 17:15:30 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
789	192.168.2.5	50855	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:30 UTC	519	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=37007&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:30 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:30 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760087-MIA
2024-04-26 17:15:30 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
790	192.168.2.5	50857	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:32 UTC	780	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=39138&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 151 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:32 UTC	151	OUT	Data Raw: 62 65 6c 2e 36 3b 65 2c 27 6c 63 70 2c 73 35 2c 38 3b 36 2c 27 73 69 7a 65 2c 33 35 32 33 30 2e 3b 35 2c 27 65 69 64 3b 35 2c 27 65 6c 54 61 67 2c 27 48 31 3b 35 2c 27 6e 65 74 2d 65 74 79 70 65 2c 27 33 67 3b 36 2c 27 6e 65 74 2d 72 74 74 2c 33 35 30 2e 3b 36 2c 27 6e 65 74 2d 64 6c 69 6e 6b 2c 31 2e 34 35 3b 36 2c 27 63 6c 73 2c 30 2e 30 31 35 35 31 39 38 30 30 39 37 33 34 32 36 37 33 35 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 Data Ascii: bel.6;e,'lcp,s5,8;6,'size,35230.;5,'eid;5,'elTag,'H1;5,'net-etype,'3g;6,'net-rtt,350.;6,'net-dlink,1.45;6,'cls,0.015519800973426735;5,'siteVersion,'new
2024-04-26 17:15:32 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:32 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760038-MIA
2024-04-26 17:15:32 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
791	192.168.2.5	50856	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:32 UTC	783	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=39141&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1197 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:32 UTC	1197	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 56 65 72 73 69 6f 6e 2f 31 2e 32 33 36 2e 30 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 4c 6f 61 64 65 72 54 79 70 65 2f 73 70 61 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 47 65 6e 65 72 69 63 2f 44 69 73 74 4d 65 74 68 6f 64 2f 43 44 4e 2f 44 65 74 65 63 74 65 64 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 2c 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 50 49 2f 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 Data Ascii: {"sm":[{"params":{"name":"Generic/Version/1.236.0/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/LoaderType/spa/Detected"},"stats":{"c":1}},{"params":{"name":"Generic/DistMethod/CDN/Detected"},"stats":{"c":1}},{"params":{"name":"API/setCustomAttri
2024-04-26 17:15:32 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:32 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760030-MIA
2024-04-26 17:15:32 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
792	192.168.2.5	50858	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:32 UTC	782	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=39142&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/signup/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 293 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:32 UTC	293	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 65 72 72 6f 72 73 2f 31 2f 65 31 36 38 61 66 63 37 62 31 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 37 37 30 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 34 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 35 35 33 7d 2c 22 Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/jserrors/1/e168afc7b1","status":200},"metrics":{"count":1,"txSize":{"t":770},"rxSize":{"t":24},"duration":{"t":553},"
2024-04-26 17:15:32 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:32 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760031-MIA
2024-04-26 17:15:32 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
793	192.168.2.5	50859	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:33 UTC	716	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&tag=DwellTime&ts=1714151730858&i=gtm&dwt=24344&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:33 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:33 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,f7479d6cbd6578812fd8fd3920614720,10.0.0.207,49430,102.129.152.220,,361522540884,1,1714151733.086,0.002,,.,0,0,0.000,0.000,-,0,0,203,122,61,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:33 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
794	192.168.2.5	50860	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:33 UTC	758	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=48727&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 293 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:33 UTC	293	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 65 72 72 6f 72 73 2f 31 2f 65 31 36 38 61 66 63 37 62 31 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 39 34 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 34 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 35 36 36 7d 2c 22 Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/jserrors/1/e168afc7b1","status":200},"metrics":{"count":1,"txSize":{"t":294},"rxSize":{"t":24},"duration":{"t":566},"
2024-04-26 17:15:34 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:34 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760036-MIA
2024-04-26 17:15:34 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
795	192.168.2.5	50861	63.32.142.159	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:34 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: 0NZNKDq00WH8GiBpx3zsVA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:35 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:35 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
796	192.168.2.5	50862	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:34 UTC	512	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=48727&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:35 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:35 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760055-MIA
2024-04-26 17:15:35 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
797	192.168.2.5	50863	52.45.52.13	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:35 UTC	484	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&tag=DwellTime&ts=1714151730858&i=gtm&dwt=24344&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:35 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:35 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,1d5abaea5cc1c805981283aed8651a9d,10.0.0.127,48766,102.129.152.220,,232624213035,1,1714151735.365,0.008,,.,0,0,0.000,0.008,-,0,0,203,302,151,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.5	50869	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:37 UTC	3210	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:38 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 138 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:15:38 UTC	138	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
799	192.168.2.5	50868	54.84.194.59	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:37 UTC	3256	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_funnel_stage=purchase_stage_user&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:37 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 163 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: https://www.xero.com
2024-04-26 17:15:37 UTC	163	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 44 49 6b 4a 43 4f 6c 42 47 7a 7a 38 43 61 65 77 52 70 33 74 6a 6f 22 2c 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["DIkJCOlBGzz8CaewRp3tjo","goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
800	192.168.2.5	50872	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:38 UTC	872	OUT	GET /tr/?id=303901320544451&ev=Purchase%20Stage%20Users&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151736128&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=2&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:38 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=126, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:15:38 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
801	192.168.2.5	50874	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:38 UTC	982	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=Purchase%20Stage%20Users&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151736128&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=2&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger;navigation-source Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:38 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:15:38 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:15:38 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-26 17:15:38 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
802	192.168.2.5	50873	74.125.134.154	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:38 UTC	957	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1327635875&gjid=1489109346&_gid=1323772131.1714151589&_u=SDCAAEABAAAAACgEKAC~&z=1328729521 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.xero.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:38 UTC	590	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.xero.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Fri, 26 Apr 2024 17:15:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:38 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
803	192.168.2.5	50877	18.210.31.191	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:38 UTC	3058	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_funnel_stage=purchase_stage_user&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898 [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:38 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 163 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:15:38 UTC	163	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 44 49 6b 4a 43 4f 6c 42 47 7a 7a 38 43 61 65 77 52 70 33 74 6a 6f 22 2c 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["DIkJCOlBGzz8CaewRp3tjo","goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
804	192.168.2.5	50875	18.210.31.191	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:38 UTC	3012	OUT	GET /saq_pxl?uid=XVsUfradtXcBUl5XS45ldg&is_js=true&landing_url=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&t=Pricing%20Plans%20%7C%20Xero%20US&tip=OO9ZD94md9fVAwGsXTvZE-lCodK-LbeuItAG6O5D8dk&host=https%3A%2F%2Fwww.xero.com&sa_conv_data_css_value=%270-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b [TRUNCATED] Host: tags.srv.stackadapt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id=s%3A0-0d5d4d00-8ed0-5bc3-42b1-703ab2f94757.8szetBXdimSaZYIsSAsBGM5v%2F90GVaXib7fKMYgzuHY; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v2=s%3ADV1NAI7QW8NCsXA6svlHV2aBmNw.H18mj%2FXbMCg%2Fjvlt8slzYQsHevT82j3BsjvVbbjzHpw; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ; sa-user-id-v3=s%3AAQAKIF8T2yqQ9k-PT5A2jJ3kJxcZ8qzTPPcXmvggm-yzkjDFEHwYBCCnwa-xBjABOgT87-jmQgTL1fnM.KFZ948nkMv0VPcHHfbAe%2FoKSM3ols6rF1dTaHaIKwOQ
2024-04-26 17:15:38 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 138 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: null
2024-04-26 17:15:38 UTC	138	IN	Data Raw: 7b 22 63 6f 6e 76 65 72 73 69 6f 6e 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 67 6f 50 6a 70 4c 67 58 79 39 52 42 39 72 59 6b 78 44 41 44 30 4f 22 5d 2c 22 72 65 74 61 72 67 65 74 69 6e 67 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 5b 22 71 68 31 72 41 66 31 38 35 4e 58 69 75 59 68 53 43 4d 52 4f 45 4b 22 5d 2c 22 6c 6f 6f 6b 61 6c 69 6b 65 5f 74 72 61 63 6b 65 72 5f 75 69 64 73 22 3a 6e 75 6c 6c 7d Data Ascii: {"conversion_tracker_uids":["goPjpLgXy9RB9rYkxDAD0O"],"retargeting_tracker_uids":["qh1rAf185NXiuYhSCMROEK"],"lookalike_tracker_uids":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
805	192.168.2.5	50880	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	640	OUT	GET /tr/?id=303901320544451&ev=Purchase%20Stage%20Users&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151736128&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=2&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:40 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=130, rtx=0, c=10, mss=1277, tbw=3404, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 26 Apr 2024 17:15:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
806	192.168.2.5	50881	157.240.14.35	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	677	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=303901320544451&ev=Purchase%20Stage%20Users&dl=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&rl=&if=false&ts=1714151736128&sw=1280&sh=1024&v=2.9.154&r=stable&a=tmgoogletagmanager&ec=2&o=4126&fbp=fb.1.1714151592759.820300878&ler=empty&cdl=API_unavailable&it=1714151615081&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:40 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-26 17:15:40 UTC	1859	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-26 17:15:40 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
807	192.168.2.5	50879	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	831	OUT	GET /sp.pl?a=10000&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:15:40 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:40 GMT Expires: Fri, 26 Apr 2024 17:15:40 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:15:40 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:15:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
808	192.168.2.5	50878	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	858	OUT	GET /sp.pl?a=10000&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&et=custom&ea=purchasestage&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:15:40 UTC	909	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:40 GMT Expires: Fri, 26 Apr 2024 17:15:40 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:15:40 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-04-26 17:15:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
809	192.168.2.5	50884	142.250.189.132	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	815	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1327635875&_u=SDCAAEABAAAAACgEKAC~&z=869746760 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:41 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
810	192.168.2.5	50887	172.217.204.155	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	713	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1327635875&gjid=1489109346&_gid=1323772131.1714151589&_u=SDCAAEABAAAAACgEKAC~&z=1328729521 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:41 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Fri, 26 Apr 2024 17:15:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:41 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
811	192.168.2.5	50885	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	599	OUT	GET /sp.pl?a=10000&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:15:41 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:15:40 GMT Expires: Fri, 26 Apr 2024 17:15:40 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:15:40 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
812	192.168.2.5	50886	76.13.32.146	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:40 UTC	626	OUT	GET /sp.pl?a=10000&b=Pricing%20Plans%20%7C%20Xero%20US&.yp=10175613&f=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&enc=UTF-8&yv=1.15.1&et=custom&ea=purchasestage&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE
2024-04-26 17:15:41 UTC	923	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:16:35 GMT Expires: Fri, 26 Apr 2024 17:16:35 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBK3gK2YCEFdCGcLEX3XpdOBwpVQ9T4YFEgEBAQEyLWY1ZtxI0iMA_eMAAA&S=AQAAAlfG3Axee1aoN48ni3YONNE; Expires=Sat, 26 Apr 2025 23:16:35 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
813	192.168.2.5	50888	142.251.35.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:41 UTC	1279	OUT	GET /activity;register_conversion=1;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:41 UTC	593	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
814	192.168.2.5	50889	142.250.64.162	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:41 UTC	1326	OUT	GET /td/fls/rul/activityi;fledge=1;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:41 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:15:41 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-26 17:15:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
815	192.168.2.5	50890	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:41 UTC	1314	OUT	GET /activityi;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 940320.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:41 UTC	1153	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://940320.fls.doubleclick.net/activityi;dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
816	192.168.2.5	50891	192.178.50.68	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:41 UTC	583	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-3776042-30&cid=1035819485.1714151589&jid=1327635875&_u=SDCAAEABAAAAACgEKAC~&z=869746760 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:42 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
817	192.168.2.5	50892	142.250.64.134	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:41 UTC	992	OUT	GET /activity;register_conversion=1;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:42 UTC	593	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
818	192.168.2.5	50893	142.250.64.230	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:42 UTC	1348	OUT	GET /activityi;dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F? HTTP/1.1 Host: 940320.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkjEXTRWqkLXdLvtWwRUZtmMrkTeKX1RFanP6E1YdHG-HNjEw8GinWwtv3VhOM; ar_debug=1
2024-04-26 17:15:43 UTC	621	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:42 GMT Expires: Fri, 26 Apr 2024 17:15:42 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:15:43 UTC	634	IN	Data Raw: 32 62 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4c 62 52 6c 2d 32 77 34 49 55 44 46 58 Data Ascii: 2b0<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CLbRl-2w4IUDFX
2024-04-26 17:15:43 UTC	61	IN	Data Raw: 25 32 46 25 32 46 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 25 32 46 75 73 25 32 46 70 72 69 63 69 6e 67 2d 70 6c 61 6e 73 25 32 46 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: %2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F"/></body></html>
2024-04-26 17:15:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
819	192.168.2.5	50894	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:43 UTC	774	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=134101&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 1813 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:43 UTC	1813	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 73 61 2e 6a 70 65 67 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 32 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 2c 22 6d 69 6e 22 3a 30 2c 22 6d 61 78 22 3a 30 2c 22 73 6f 73 22 3a 30 2c 22 63 22 3a 32 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 Data Ascii: {"xhr":[{"params":{"hostname":"tags.srv.stackadapt.com","port":"443","protocol":"https","host":"tags.srv.stackadapt.com:443","pathname":"/sa.jpeg","method":"GET","status":200},"metrics":{"count":2,"txSize":{"t":0,"min":0,"max":0,"sos":0,"c":2},"rxSize":{"
2024-04-26 17:15:44 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:43 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760087-MIA
2024-04-26 17:15:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
820	192.168.2.5	50896	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:43 UTC	837	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151742173&i=gtm&dwt=11249&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:44 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:43 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,fa670409dd24e12ba00cb4ec496e1ade,10.0.0.207,53428,102.129.152.220,,361522609567,1,1714151743.992,0.006,,.,0,0,0.000,0.008,-,0,0,203,222,111,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
821	192.168.2.5	50898	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:43 UTC	842	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151742192&i=gtm&dwt=14&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:44 UTC	373	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:43 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,80109ff2b32c313b51087eecd1e49cef,10.0.0.207,1296,102.129.152.220,,8589573321,1,1714151743.991,0.006,,.,0,0,0.000,0.004,-,0,0,203,127,63,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
822	192.168.2.5	50897	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:43 UTC	721	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151742251&i=gtm&dwt=135&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:44 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:43 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,3dbcd35f17375b4d1676f204588f2780,10.0.0.207,55750,102.129.152.220,,232624267467,1,1714151743.987,0.002,,.,0,0,0.000,0.004,-,0,0,203,259,129,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
823	192.168.2.5	50900	172.217.15.194	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:44 UTC	1139	OUT	GET /ddm/fls/z/dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://940320.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:44 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
824	192.168.2.5	50895	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:44 UTC	771	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=134103&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 527 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:44 UTC	527	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 32 71 75 67 2c 6c 2c 2c 2c 27 47 45 54 2c 35 6b 2c 27 74 61 67 73 2e 73 72 76 2e 73 74 61 63 6b 61 64 61 70 74 2e 63 6f 6d 3a 34 34 33 2c 27 2f 73 61 2e 6a 70 65 67 2c 2c 69 33 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 3b 32 2c 31 2c 32 71 75 6a 2c 6a 2c 2c 2c 30 2c 35 6b 2c 31 2c 32 2c 2c 69 33 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 32 71 74 70 2c 68 62 2c 2c 2c 27 50 4f 53 54 2c 35 6d 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 2c 62 71 2c 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 3b 32 2c 31 2c 32 71 74 68 2c 69 62 2c 2c 2c 36 2c 35 6d 2c 37 2c 38 2c 62 32 2c 2c 31 2c 33 2c 21 21 21 3b 35 2c 34 2c 35 Data Ascii: bel.7;2,1,2qug,l,,,'GET,5k,'tags.srv.stackadapt.com:443,'/sa.jpeg,,i3,1,'0,!!!;5,'siteVersion,'new;2,1,2quj,j,,,0,5k,1,2,,i3,1,3,!!!;5,4,5;2,1,2qtp,hb,,,'POST,5m,'www.xero.com:443,'/api/events/v1/,bq,,1,3,!!!;5,4,5;2,1,2qth,ib,,,6,5m,7,8,b2,,1,3,!!!;5,4,5
2024-04-26 17:15:44 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:44 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760074-MIA
2024-04-26 17:15:44 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
825	192.168.2.5	50899	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:44 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: vNzzIVPIIv3eR0W8DSMVqw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:44 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:44 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
826	192.168.2.5	50901	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	758	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=60156&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 293 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:45 UTC	293	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 65 72 72 6f 72 73 2f 31 2f 65 31 36 38 61 66 63 37 62 31 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 39 33 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 34 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 35 38 31 7d 2c 22 Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/jserrors/1/e168afc7b1","status":200},"metrics":{"count":1,"txSize":{"t":293},"rxSize":{"t":24},"duration":{"t":581},"
2024-04-26 17:15:45 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:45 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760081-MIA
2024-04-26 17:15:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
827	192.168.2.5	50902	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	527	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=134101&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:45 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:45 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760082-MIA
2024-04-26 17:15:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
828	192.168.2.5	50903	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	525	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=134103&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:45 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:45 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760067-MIA
2024-04-26 17:15:45 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
829	192.168.2.5	50904	52.45.52.13	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	610	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151742192&i=gtm&dwt=14&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:45 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:45 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,d39c398129464da3bd32d7ec48583252,10.0.0.127,11732,102.129.152.220,,232624278145,1,1714151745.855,0.003,,.,0,0,0.000,0.004,-,0,0,203,266,133,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
830	192.168.2.5	50905	52.45.52.13	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	605	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151742173&i=gtm&dwt=11249&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:45 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:45 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,b2fa3062e75b179508d1010a44d344c7,10.0.0.127,51368,102.129.152.220,,232877626028,1,1714151745.857,0.002,,.,0,0,0.000,0.004,-,0,0,203,141,70,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
831	192.168.2.5	50906	52.45.52.13	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	489	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&tag=DwellTime&ts=1714151742251&i=gtm&dwt=135&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:45 UTC	373	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:45 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,04ef0a7bc0caca981c2865a724d8665a,10.0.0.127,12708,102.129.152.220,,8589580252,1,1714151745.866,0.002,,.,0,0,0.000,0.000,-,0,0,203,85,42,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
832	192.168.2.5	50907	192.178.50.66	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	893	OUT	GET /ddm/fls/z/dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:45 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 26 Apr 2024 17:15:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:15:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
833	192.168.2.5	50908	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:45 UTC	512	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=60156&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:46 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:46 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760036-MIA
2024-04-26 17:15:46 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
834	192.168.2.5	50909	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:46 UTC	781	OUT	POST /jserrors/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=191841&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 367 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://in.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://in.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:46 UTC	367	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 6a 61 78 2f 45 76 65 6e 74 73 2f 45 78 63 6c 75 64 65 64 2f 41 67 65 6e 74 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 31 7d 7d 5d 2c 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 65 72 72 6f 72 73 2f 31 2f 62 64 36 31 62 36 37 36 62 65 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 Data Ascii: {"sm":[{"params":{"name":"Ajax/Events/Excluded/Agent"},"stats":{"c":1}}],"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/jserrors/1/bd61b676be","status":200},"metrics
2024-04-26 17:15:46 UTC	309	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:46 GMT content-type: image/gif access-control-allow-origin: https://in.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760020-MIA
2024-04-26 17:15:46 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
835	192.168.2.5	50913	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:46 UTC	789	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=137129&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 73 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:46 UTC	73	OUT	Data Raw: 7b 22 73 6d 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 41 6a 61 78 2f 45 76 65 6e 74 73 2f 45 78 63 6c 75 64 65 64 2f 41 67 65 6e 74 22 7d 2c 22 73 74 61 74 73 22 3a 7b 22 63 22 3a 32 7d 7d 5d 7d Data Ascii: {"sm":[{"params":{"name":"Ajax/Events/Excluded/Agent"},"stats":{"c":2}}]}
2024-04-26 17:15:46 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:46 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760040-MIA
2024-04-26 17:15:46 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
836	192.168.2.5	50912	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:46 UTC	790	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=137129&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/pricing-plans/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 580 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:46 UTC	580	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 68 6f 73 74 6e 61 6d 65 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 62 61 6d 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 6a 73 65 72 72 6f 72 73 2f 31 2f 65 31 36 38 61 66 63 37 62 31 22 2c 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 31 38 31 33 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 32 34 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 32 30 30 32 7d Data Ascii: {"xhr":[{"params":{"method":"POST","hostname":"bam.nr-data.net","port":"443","protocol":"https","host":"bam.nr-data.net:443","pathname":"/jserrors/1/e168afc7b1","status":200},"metrics":{"count":1,"txSize":{"t":1813},"rxSize":{"t":24},"duration":{"t":2002}
2024-04-26 17:15:46 UTC	354	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:46 GMT content-type: image/gif cross-origin-resource-policy: cross-origin access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true access-control-allow-origin: https://www.xero.com x-served-by: cache-mia-kmia1760051-MIA
2024-04-26 17:15:46 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
837	192.168.2.5	50911	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:46 UTC	836	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151745111&i=gtm&dwt=2907&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:46 UTC	377	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:46 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,53d3e9df30095adc40686f265ea6bcbc,10.0.0.207,17254,102.129.152.220,,232624283880,1,1714151746.706,0.002,,.,0,0,0.000,0.000,-,0,0,203,216,108,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
838	192.168.2.5	50910	52.200.166.19	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:46 UTC	841	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151745123&i=gtm&dwt=9&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:46 UTC	375	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:46 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,0d827f358b122008a76300ce5c5c7b83,10.0.0.207,7804,102.129.152.220,,232877631443,1,1714151746.706,0.002,,.,0,0,0.000,0.000,-,0,0,203,134,67,10,34729,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
839	192.168.2.5	50914	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:46 UTC	537	OUT	GET /jserrors/1/bd61b676be?a=1134228971&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=191841&ck=1&ref=https://in.xero.com/m/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1 HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:47 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:47 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760095-MIA
2024-04-26 17:15:47 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
840	192.168.2.5	50915	52.45.52.13	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:47 UTC	604	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151745111&i=gtm&dwt=2907&ive=blur HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:47 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:47 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,d73c0dddfc566d5d4204be2591afaaca,10.0.0.127,33334,102.129.152.220,,361522628628,1,1714151747.372,0.002,,.,0,0,0.000,0.004,-,0,0,203,176,88,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
841	192.168.2.5	50916	52.45.52.13	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:47 UTC	609	OUT	GET /_/ad/9cf7274f1587405384d41bb446f7e005/pixel?j=1&u=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&tag=DwellTime&ts=1714151745123&i=gtm&dwt=9&ive=webkitHidden HTTP/1.1 Host: q.quora.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:15:47 UTC	376	IN	HTTP/1.1 200 OK Content-Type: image/gif Date: Fri, 26 Apr 2024 17:15:47 GMT Server: nginx Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Q-Stat: ,1981850aaf4a847e05a1b7a318569e8f,10.0.0.127,33346,102.129.152.220,,361522628629,1,1714151747.372,0.002,,.,0,0,0.000,0.004,-,0,0,203,158,79,10,26847,,,,,,-, Content-Length: 43 Connection: Close
2024-04-26 17:15:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
842	192.168.2.5	50917	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:48 UTC	783	OUT	POST /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=169058&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 263 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:48 UTC	263	OUT	Data Raw: 7b 22 78 68 72 22 3a 5b 7b 22 70 61 72 61 6d 73 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 22 2c 22 70 6f 72 74 22 3a 22 34 34 33 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 68 6f 73 74 22 3a 22 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 22 2c 22 70 61 74 68 6e 61 6d 65 22 3a 22 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 22 2c 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 73 74 61 74 75 73 22 3a 32 30 32 7d 2c 22 6d 65 74 72 69 63 73 22 3a 7b 22 63 6f 75 6e 74 22 3a 31 2c 22 74 78 53 69 7a 65 22 3a 7b 22 74 22 3a 34 33 30 7d 2c 22 72 78 53 69 7a 65 22 3a 7b 22 74 22 3a 30 7d 2c 22 64 75 72 61 74 69 6f 6e 22 3a 7b 22 74 22 3a 37 35 35 7d 2c 22 74 69 6d 65 22 3a 7b 22 74 22 3a 31 33 35 Data Ascii: {"xhr":[{"params":{"hostname":"www.xero.com","port":"443","protocol":"https","host":"www.xero.com:443","pathname":"/api/events/v1/","method":"POST","status":202},"metrics":{"count":1,"txSize":{"t":430},"rxSize":{"t":0},"duration":{"t":755},"time":{"t":135
2024-04-26 17:15:48 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:48 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760034-MIA
2024-04-26 17:15:48 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
843	192.168.2.5	50918	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:48 UTC	780	OUT	POST /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=169062&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive Content-Length: 96 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://www.xero.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.xero.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:48 UTC	96	OUT	Data Raw: 62 65 6c 2e 37 3b 32 2c 31 2c 32 77 62 69 2c 6b 7a 2c 2c 2c 27 50 4f 53 54 2c 35 6d 2c 27 77 77 77 2e 78 65 72 6f 2e 63 6f 6d 3a 34 34 33 2c 27 2f 61 70 69 2f 65 76 65 6e 74 73 2f 76 31 2f 2c 62 79 2c 2c 31 2c 27 30 2c 21 21 21 3b 35 2c 27 73 69 74 65 56 65 72 73 69 6f 6e 2c 27 6e 65 77 Data Ascii: bel.7;2,1,2wbi,kz,,,'POST,5m,'www.xero.com:443,'/api/events/v1/,by,,1,'0,!!!;5,'siteVersion,'new
2024-04-26 17:15:48 UTC	310	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:48 GMT content-type: image/gif access-control-allow-origin: https://www.xero.com access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760046-MIA
2024-04-26 17:15:48 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
844	192.168.2.5	50919	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:48 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: Rau+G/6U+qYPDRjsCAdDIg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:49 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:49 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
845	192.168.2.5	50921	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:48 UTC	537	OUT	GET /jserrors/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=169058&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:49 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:49 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760027-MIA
2024-04-26 17:15:49 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
846	192.168.2.5	50920	162.247.243.29	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:48 UTC	535	OUT	GET /events/1/e168afc7b1?a=1023385160&sa=1&v=1.236.0&t=Unnamed%20Transaction&rst=169062&ck=0&s=bd1971df8f568aac&ref=https://www.xero.com/us/try-now/manage-invoices/ HTTP/1.1 Host: bam.nr-data.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=c1b656af79b55f04
2024-04-26 17:15:49 UTC	291	IN	HTTP/1.1 200 Connection: close Content-Length: 24 date: Fri, 26 Apr 2024 17:15:49 GMT content-type: image/gif access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS access-control-allow-credentials: true x-served-by: cache-mia-kmia1760036-MIA
2024-04-26 17:15:49 UTC	24	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 Data Ascii: GIF89a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
847	192.168.2.5	50923	52.50.39.109	443	3396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:15:49 UTC	525	OUT	GET /api/v2/client/ws?v=7&site_id=3197823 HTTP/1.1 Host: ws.hotjar.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://www.xero.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: 1MFe53aobj/7FPJefWax0w== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-04-26 17:15:50 UTC	145	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 17:15:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 16 Connection: close
2024-04-26 17:15:50 UTC	16	IN	Data Raw: 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400: Bad Request

Target ID:	0
Start time:	19:12:05
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Activity Statement for User 01Apr2024-30Apr2024.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:12:06
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:12:06
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1712,i,17945822127698390932,11913859670726568771,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:12:31
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://in.xero.com/En1MigUhA2gJxSPux1GC4hDwm3SGlPKRBAnDWDO1?utm_source=statementsPdfLink"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:12:33
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2008,i,4408813981360811890,12628688319291748054,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://xero.com	Matcher: Template: hsbc matched with high similarity
Source: https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals	Matcher: Template: hsbc matched with high similarity
Source: https://www.xero.com/us/pricing-plans/	Matcher: Template: hsbc matched with high similarity
Source: https://www.xero.com/us/	Matcher: Template: hsbc matched with high similarity
Source: https://www.xero.com/us/signup/	Matcher: Template: hsbc matched with high similarity

Source: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782#locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero	HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782#locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero	HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782#locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero	HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/53aa8912dec7e10d38f59f36/index.html?templateId=53aa8912dec7e10d38f59f36&businessunitId=4becd84a00006400050b6782#locale=en-NZ&styleHeight=100%25&styleWidth=100%25&theme=light&tags=product&stars=4%2C5&schemaType=Organization&sku=Xero&name=Xero	HTTP Parser: No favicon
Source: https://s.company-target.com/s/sync?exc=lr	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=COSek6aw4IUDFXVZCAQd77IKHA;src=9401320;type=pagev0;cat=globa000;ord=1;num=9017579688303;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1114865488;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CMyjmKaw4IUDFedWCAQdIbwDRQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=8355268344632;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=2129813676;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347&google_gid=CAESEHFXfyZ9kVq0mrodDvvN5-s&google_cver=1	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/upb/?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CM2V9bGw4IUDFfuvOgUdTIIG5Q;src=9401320;type=pagev0;cat=globa000;ord=1;num=3604611422185;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=617245679;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CKG4ibKw4IUDFd-6OgUdIoQHFg;src=9401320;type=pagev0;cat=globa002;ord=1;num=6401052246032;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1692913698;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	HTTP Parser: No favicon
Source: https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/pricing-plans/	HTTP Parser: No favicon
Source: https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/pricing-plans/	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=2808008891046894518&ttd_tdid=e09cd2aa-7185-40a5-bf74-4fc29b294347	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CMDX8rew4IUDFWdZCAQdbp0D5w;src=9401320;type=pagev0;cat=globa002;ord=1;num=6249120967098;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=269983327;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CM_j_bew4IUDFeFYCAQdErMMHw;src=9401320;type=pagev0;cat=globa000;ord=1;num=3718221080596;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1879839855;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?	HTTP Parser: No favicon
Source: https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/	HTTP Parser: No favicon
Source: https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/	HTTP Parser: No favicon
Source: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e09cd2aa-7185-40a5-bf74-4fc29b294347&expiration=1716743635&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://secure-gl.imrworldwide.com/cgi-bin/m?ci=tradedesk&cg=e09cd2aa-7185-40a5-bf74-4fc29b294347	HTTP Parser: No favicon
Source: https://d.agkn.com/pixel/10751/?che=1714151636619&ip=102.129.152.220	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CNb4lMaw4IUDFelHCAQdt9AH1Q;src=9401320;type=pagev0;cat=globa002;ord=1;num=5492282081951;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;ps=1;pcor=629773977;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=COfvlMaw4IUDFeFZCAQdWWsB5g;src=9401320;type=pagev0;cat=globa000;ord=1;num=4089933540900;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Ftry-now%2Fmanage-invoices%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=746899171;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals?	HTTP Parser: No favicon
Source: https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Ftry-now%2Fmanage-invoices%2F%3Futm_source%3Dxero-invoice%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-d-lf-xeroinvoicereferrals&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/try-now/manage-invoices/?utm_source=xero-invoice&utm_medium=referral&utm_campaign=global-d-lf-xeroinvoicereferrals	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=yjn0gup	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=addthis	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CKHW1s-w4IUDFfywOgUdjRkKPQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=2141145805681;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=445394625;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CNOx1s-w4IUDFTRYCAQdeL4Ohw;src=9401320;type=pagev0;cat=globa000;ord=1;num=4561227295828;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1617148952;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=1i071nc	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://mid.rkdms.com/bct?pid=437ea0fb-a4b9-4984-a0a2-8cbfec2ccecc&puid=cce91c92ed659663e5c02bfbce595320&sha256=7ce3f6ced5cb6000d9a64547418ef36a1e1120666513a68c874bf00e643ef69b&sha1=36b9ae06c3bb2a08fe12ef798c0b97abcee8d7ed&probflag=1&score=0.07526959&_ct=img	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=4h3yn1f	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=COPm59Ww4IUDFZCxOgUdm0sMjA;src=9401320;type=pagev0;cat=globa002;ord=1;num=6485184252676;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;ps=1;pcor=513074472;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CO_T9tWw4IUDFYmrOgUdgVEKjA;src=9401320;type=pagev0;cat=globa000;ord=1;num=5359770135784;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1483141409;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2F?	HTTP Parser: No favicon
Source: https://eb2.3lift.com/xuid?ld=1&mid=3658&xuid=e09cd2aa-7185-40a5-bf74-4fc29b294347&dongle=0cfd&gdpr=0&cmp_cs=&us_privacy=	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CITPyNiw4IUDFR-qOgUd1zQNFQ;src=9401320;type=pagev0;cat=globa002;ord=1;num=566525278229;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;ps=1;pcor=1485930022;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0za200;gcd=13l3l3l3l1;dma=0;epver=2;match_id=162dff65-da12-4bc6-ad62-6b12d5f14651;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F?	HTTP Parser: No favicon
Source: https://9401320.fls.doubleclick.net/activityi;dc_pre=CKS01Niw4IUDFbRXCAQdNaAEfQ;src=9401320;type=pagev0;cat=globa000;ord=1;num=3677314252337;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fsignup%2F;u7=function(a)%7Ba.set(%22dimension%22%2Bb%2Ca.get(%22clientId%22))%7D;ps=1;pcor=1303203212;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F?	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le6fDsoAAAAABLpuIc7lmLNZEa2f-gLLKbb4bnV&co=aHR0cHM6Ly93d3cueGVyby5jb206NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=j80nlnbc54q7	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeivbwbAAAAACadmd9FggGikXMNXyCwDJksdCAh&co=aHR0cHM6Ly93d3cueGVyby5jb206NDQz&hl=en&type=image&v=V6_85qpc2Xf2sbe3xTnRte7m&theme=light&size=normal&badge=bottomright&cb=4sv6t3ujo84u	HTTP Parser: No favicon
Source: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=e09cd2aa-7185-40a5-bf74-4fc29b294347	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=crosswise	HTTP Parser: No favicon
Source: https://insight.adsrvr.org/track/up?adv=9nlrx8p&ref=https%3A%2F%2Fwww.xero.com%2Fus%2Fsignup%2F&upid=e7m2c49&upv=1.1.0&td1=https://www.xero.com/us/signup/	HTTP Parser: No favicon
Source: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8	HTTP Parser: No favicon
Source: https://940320.fls.doubleclick.net/activityi;dc_pre=CLbRl-2w4IUDFXCJ7gEdBXEDgg;src=940320;type=websi0;cat=globa002;ord=1;num=6289602892660;npa=0;auiddc=2064983717.1714151587;u1=%2Fus%2Fpricing-plans%2F;ps=1;pcor=1039152548;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44o0z8830923470za201;gcd=13l3l3l3l1;dma=0;epver=2;~oref=https%3A%2F%2Fwww.xero.com%2Fus%2Fpricing-plans%2F?	HTTP Parser: No favicon

Source: https://www.xero.com/us/signup/	HTTP Parser: No <meta name="author".. found
Source: https://www.xero.com/us/signup/	HTTP Parser: No <meta name="author".. found
Source: https://www.xero.com/us/signup/	HTTP Parser: No <meta name="author".. found

Source: https://www.xero.com/us/signup/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.xero.com/us/signup/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.xero.com/us/signup/	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 35.174.127.31 35.174.127.31
Source: Joe Sandbox View	IP Address: 34.237.73.95 34.237.73.95
Source: Joe Sandbox View	IP Address: 192.184.68.149 192.184.68.149

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: chromecache_870.9.dr	String found in binary or memory: 2024 Xero Limited. All rights reserved. \"Xero\" and \"Beautiful business\" are trademarks of Xero Limited.","linkGroups":[{"heading":"Accounting software","links":[{"current":false,"text":"See all Xero features","href":"/us/accounting-software/all-features/","leadingText":null},{"current":false,"text":"Plans","href":"/us/pricing-plans/","leadingText":null}]},{"heading":"Xero for","links":[{"current":false,"text":"Small business","href":"/us/accounting-software/","leadingText":null},{"current":false,"text":"Accountants \u0026 bookkeepers","href":"/us/accountants-bookkeepers/","leadingText":null}]},{"heading":"Support","links":[{"current":false,"text":"Get support","href":"https://central.xero.com/s/","leadingText":null},{"current":false,"text":"Take a course","href":"https://central.xero.com/s/learning","leadingText":null}]},{"heading":"Company","links":[{"current":false,"text":"About Xero","href":"/us/about/","leadingText":null},{"current":false,"text":"Contact us","href":"/us/about/contact/","leadingText":null}]}],"regionSwitcher":{"buttonText":"United States (USD)","activeRegionCode":"us","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","label":"Region","regions":[{"name":"Global","code":"zz","href":"/try-now/manage-invoices/"},{"name":"Hong Kong","code":"hk","href":"/hk/try-now/manage-invoices/"},{"name":"South Africa","code":"za","href":"/za/try-now/manage-invoices/"},{"name":"Malaysia","code":"my","href":"/my/try-now/manage-invoices/"},{"name":"New Zealand","code":"nz","href":"/nz/try-now/manage-invoices/"},{"name":"Australia","code":"au","href":"/au/try-now/manage-invoices/"},{"name":"Singapore","code":"sg","href":"/sg/try-now/manage-invoices/"},{"name":"Philippines","code":"ph","href":"/ph/try-now/manage-invoices/"},{"name":"United Kingdom","code":"uk","href":"/uk/try-now/manage-invoices/"},{"name":"Indonesia","code":"id","href":"/id/try-now/manage-invoices/"},{"name":"Ireland","code":"ie","href":"/ie/try-now/manage-invoices/"},{"name":"Canada","code":"ca","href":"/ca/try-now/manage-invoices/"},{"name":"United States","code":"us","href":"/us/try-now/manage-invoices/"}],"popoverHeading":"Change region"},"social":[{"id":"footer-Twitter","href":"https://twitter.com/xero/","title":"Twitter","src":"/content/dam/xero/pilot-images/admin/icons/social-media/x-twitter-icon.svg#ico"},{"id":"footer-Facebook","href":"https://www.facebook.com/xero","title":"Facebook","src":"/content/dam/xero/pilot-images/admin/icons/social-media/facebook-icon.svg#ico"},{"id":"footer-Youtube","href":"https://www.youtube.com/user/XeroOnlineAccounting","title":"Youtube","src":"/content/dam/xero/pilot-images/admin/icons/social-media/youtube-icon.svg#ico"},{"id":"footer-Linkedin","href":"https://www.linkedin.com/company/xero","title":"Linkedin","src":"/content/dam/xero/pilot-images/admin/icons/social-media/linkedin-icon.svg#ico"},{"id":"footer-Instagram","href":"https://www.instagram.com/xer
Source: chromecache_870.9.dr	String found in binary or memory: 2024 Xero Limited. All rights reserved. \"Xero\" and \"Beautiful business\" are trademarks of Xero Limited.","linkGroups":[{"heading":"Accounting software","links":[{"current":false,"text":"See all Xero features","href":"/us/accounting-software/all-features/","leadingText":null},{"current":false,"text":"Plans","href":"/us/pricing-plans/","leadingText":null}]},{"heading":"Xero for","links":[{"current":false,"text":"Small business","href":"/us/accounting-software/","leadingText":null},{"current":false,"text":"Accountants \u0026 bookkeepers","href":"/us/accountants-bookkeepers/","leadingText":null}]},{"heading":"Support","links":[{"current":false,"text":"Get support","href":"https://central.xero.com/s/","leadingText":null},{"current":false,"text":"Take a course","href":"https://central.xero.com/s/learning","leadingText":null}]},{"heading":"Company","links":[{"current":false,"text":"About Xero","href":"/us/about/","leadingText":null},{"current":false,"text":"Contact us","href":"/us/about/contact/","leadingText":null}]}],"regionSwitcher":{"buttonText":"United States (USD)","activeRegionCode":"us","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","label":"Region","regions":[{"name":"Global","code":"zz","href":"/try-now/manage-invoices/"},{"name":"Hong Kong","code":"hk","href":"/hk/try-now/manage-invoices/"},{"name":"South Africa","code":"za","href":"/za/try-now/manage-invoices/"},{"name":"Malaysia","code":"my","href":"/my/try-now/manage-invoices/"},{"name":"New Zealand","code":"nz","href":"/nz/try-now/manage-invoices/"},{"name":"Australia","code":"au","href":"/au/try-now/manage-invoices/"},{"name":"Singapore","code":"sg","href":"/sg/try-now/manage-invoices/"},{"name":"Philippines","code":"ph","href":"/ph/try-now/manage-invoices/"},{"name":"United Kingdom","code":"uk","href":"/uk/try-now/manage-invoices/"},{"name":"Indonesia","code":"id","href":"/id/try-now/manage-invoices/"},{"name":"Ireland","code":"ie","href":"/ie/try-now/manage-invoices/"},{"name":"Canada","code":"ca","href":"/ca/try-now/manage-invoices/"},{"name":"United States","code":"us","href":"/us/try-now/manage-invoices/"}],"popoverHeading":"Change region"},"social":[{"id":"footer-Twitter","href":"https://twitter.com/xero/","title":"Twitter","src":"/content/dam/xero/pilot-images/admin/icons/social-media/x-twitter-icon.svg#ico"},{"id":"footer-Facebook","href":"https://www.facebook.com/xero","title":"Facebook","src":"/content/dam/xero/pilot-images/admin/icons/social-media/facebook-icon.svg#ico"},{"id":"footer-Youtube","href":"https://www.youtube.com/user/XeroOnlineAccounting","title":"Youtube","src":"/content/dam/xero/pilot-images/admin/icons/social-media/youtube-icon.svg#ico"},{"id":"footer-Linkedin","href":"https://www.linkedin.com/company/xero","title":"Linkedin","src":"/content/dam/xero/pilot-images/admin/icons/social-media/linkedin-icon.svg#ico"},{"id":"footer-Instagram","href":"https://www.instagram.com/xer
Source: chromecache_870.9.dr	String found in binary or memory: 2024 Xero Limited. All rights reserved. \"Xero\" and \"Beautiful business\" are trademarks of Xero Limited.","linkGroups":[{"heading":"Accounting software","links":[{"current":false,"text":"See all Xero features","href":"/us/accounting-software/all-features/","leadingText":null},{"current":false,"text":"Plans","href":"/us/pricing-plans/","leadingText":null}]},{"heading":"Xero for","links":[{"current":false,"text":"Small business","href":"/us/accounting-software/","leadingText":null},{"current":false,"text":"Accountants \u0026 bookkeepers","href":"/us/accountants-bookkeepers/","leadingText":null}]},{"heading":"Support","links":[{"current":false,"text":"Get support","href":"https://central.xero.com/s/","leadingText":null},{"current":false,"text":"Take a course","href":"https://central.xero.com/s/learning","leadingText":null}]},{"heading":"Company","links":[{"current":false,"text":"About Xero","href":"/us/about/","leadingText":null},{"current":false,"text":"Contact us","href":"/us/about/contact/","leadingText":null}]}],"regionSwitcher":{"buttonText":"United States (USD)","activeRegionCode":"us","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","label":"Region","regions":[{"name":"Global","code":"zz","href":"/try-now/manage-invoices/"},{"name":"Hong Kong","code":"hk","href":"/hk/try-now/manage-invoices/"},{"name":"South Africa","code":"za","href":"/za/try-now/manage-invoices/"},{"name":"Malaysia","code":"my","href":"/my/try-now/manage-invoices/"},{"name":"New Zealand","code":"nz","href":"/nz/try-now/manage-invoices/"},{"name":"Australia","code":"au","href":"/au/try-now/manage-invoices/"},{"name":"Singapore","code":"sg","href":"/sg/try-now/manage-invoices/"},{"name":"Philippines","code":"ph","href":"/ph/try-now/manage-invoices/"},{"name":"United Kingdom","code":"uk","href":"/uk/try-now/manage-invoices/"},{"name":"Indonesia","code":"id","href":"/id/try-now/manage-invoices/"},{"name":"Ireland","code":"ie","href":"/ie/try-now/manage-invoices/"},{"name":"Canada","code":"ca","href":"/ca/try-now/manage-invoices/"},{"name":"United States","code":"us","href":"/us/try-now/manage-invoices/"}],"popoverHeading":"Change region"},"social":[{"id":"footer-Twitter","href":"https://twitter.com/xero/","title":"Twitter","src":"/content/dam/xero/pilot-images/admin/icons/social-media/x-twitter-icon.svg#ico"},{"id":"footer-Facebook","href":"https://www.facebook.com/xero","title":"Facebook","src":"/content/dam/xero/pilot-images/admin/icons/social-media/facebook-icon.svg#ico"},{"id":"footer-Youtube","href":"https://www.youtube.com/user/XeroOnlineAccounting","title":"Youtube","src":"/content/dam/xero/pilot-images/admin/icons/social-media/youtube-icon.svg#ico"},{"id":"footer-Linkedin","href":"https://www.linkedin.com/company/xero","title":"Linkedin","src":"/content/dam/xero/pilot-images/admin/icons/social-media/linkedin-icon.svg#ico"},{"id":"footer-Instagram","href":"https://www.instagram.com/xer
Source: chromecache_870.9.dr	String found in binary or memory: 2024 Xero Limited. All rights reserved. \"Xero\" and \"Beautiful business\" are trademarks of Xero Limited.","linkGroups":[{"heading":"Accounting software","links":[{"current":false,"text":"See all Xero features","href":"/us/accounting-software/all-features/","leadingText":null},{"current":false,"text":"Plans","href":"/us/pricing-plans/","leadingText":null}]},{"heading":"Xero for","links":[{"current":false,"text":"Small business","href":"/us/accounting-software/","leadingText":null},{"current":false,"text":"Accountants \u0026 bookkeepers","href":"/us/accountants-bookkeepers/","leadingText":null}]},{"heading":"Support","links":[{"current":false,"text":"Get support","href":"https://central.xero.com/s/","leadingText":null},{"current":false,"text":"Take a course","href":"https://central.xero.com/s/learning","leadingText":null}]},{"heading":"Company","links":[{"current":false,"text":"About Xero","href":"/us/about/","leadingText":null},{"current":false,"text":"Contact us","href":"/us/about/contact/","leadingText":null}]}],"regionSwitcher":{"buttonText":"United States (USD)","activeRegionCode":"us","popoverDescription":"You're on our United States website. Change your region to see information and pricing for another location.","label":"Region","regions":[{"name":"Global","code":"zz","href":"/try-now/manage-invoices/"},{"name":"Hong Kong","code":"hk","href":"/hk/try-now/manage-invoices/"},{"name":"South Africa","code":"za","href":"/za/try-now/manage-invoices/"},{"name":"Malaysia","code":"my","href":"/my/try-now/manage-invoices/"},{"name":"New Zealand","code":"nz","href":"/nz/try-now/manage-invoices/"},{"name":"Australia","code":"au","href":"/au/try-now/manage-invoices/"},{"name":"Singapore","code":"sg","href":"/sg/try-now/manage-invoices/"},{"name":"Philippines","code":"ph","href":"/ph/try-now/manage-invoices/"},{"name":"United Kingdom","code":"uk","href":"/uk/try-now/manage-invoices/"},{"name":"Indonesia","code":"id","href":"/id/try-now/manage-invoices/"},{"name":"Ireland","code":"ie","href":"/ie/try-now/manage-invoices/"},{"name":"Canada","code":"ca","href":"/ca/try-now/manage-invoices/"},{"name":"United States","code":"us","href":"/us/try-now/manage-invoices/"}],"popoverHeading":"Change region"},"social":[{"id":"footer-Twitter","href":"https://twitter.com/xero/","title":"Twitter","src":"/content/dam/xero/pilot-images/admin/icons/social-media/x-twitter-icon.svg#ico"},{"id":"footer-Facebook","href":"https://www.facebook.com/xero","title":"Facebook","src":"/content/dam/xero/pilot-images/admin/icons/social-media/facebook-icon.svg#ico"},{"id":"footer-Youtube","href":"https://www.youtube.com/user/XeroOnlineAccounting","title":"Youtube","src":"/content/dam/xero/pilot-images/admin/icons/social-media/youtube-icon.svg#ico"},{"id":"footer-Linkedin","href":"https://www.linkedin.com/company/xero","title":"Linkedin","src":"/content/dam/xero/pilot-images/admin/icons/social-media/linkedin-icon.svg#ico"},{"id":"footer-Instagram","href":"https://www.instagram.com/xer
Source: chromecache_795.9.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=null;e.exports=new h(function(d,e){try{n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}}}catch(a){return}function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=func
Source: chromecache_825.9.dr	String found in binary or memory: Math.round(p);v["gtm.videoCurrentTime"]=Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Qj:function(){e=zb()},sd:function(){d()}}};var dc=ka(["data-gtm-yt-inspected-"]),AC=["www.youtube.com","www.youtube-nocookie.com"],BC,CC=!1; equals www.youtube.com (Youtube)
Source: chromecache_804.9.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var h=iA(a,c,e);M(121);if("https://www.facebook.com/tr/"===h["gtm.elementUrl"])return M(122),!0;if(d&&f){for(var m=Jb(b,g.length),n=0;n<g.length;++n)g[n](h,m);return m.done}for(var p=0;p<g.length;++p)g[p](h,function(){});return!0},lA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_825.9.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Xg:d,Vg:e,Wg:f,Ih:g,Jh:h,ye:m,Ab:b},p=D.YT,q=function(){IC(n)};if(p)return p.ready&&p.ready(q),b;var r=D.onYouTubeIframeAPIReady;D.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(LC(w,"iframe_api")\|\|LC(w,"player_api"))return b}for(var x=H.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!CC&&JC(x[A],n.ye))return tc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_804.9.dr, chromecache_758.9.dr, chromecache_865.9.dr, chromecache_806.9.dr, chromecache_651.9.dr	String found in binary or memory: return b}yC.J="internal.enableAutoEventOnTimer";var dc=ka(["data-gtm-yt-inspected-"]),AC=["www.youtube.com","www.youtube-nocookie.com"],BC,CC=!1; equals www.youtube.com (Youtube)
Source: chromecache_804.9.dr	String found in binary or memory: var NB=function(a,b,c,d,e){var f=Jz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Jz("fsl","nv.ids",[]):Jz("fsl","ids",[]);if(!g.length)return!0;var h=Fz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);M(121);if("https://www.facebook.com/tr/"===m)return M(122),!0;h["gtm.elementUrl"]=m;h["gtm.formCanceled"]=c;null!=a.getAttribute("name")&&(h["gtm.interactedFormName"]=a.getAttribute("name"));e&&(h["gtm.formSubmitElement"]=e,h["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!uy(h,vy(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: in.xero.com
Source: global traffic	DNS traffic detected: DNS query: edge.xero.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js-agent.newrelic.com
Source: global traffic	DNS traffic detected: DNS query: bam.nr-data.net
Source: global traffic	DNS traffic detected: DNS query: product-analytics-bff.xero.com
Source: global traffic	DNS traffic detected: DNS query: widget.intercom.io
Source: global traffic	DNS traffic detected: DNS query: js.intercomcdn.com
Source: global traffic	DNS traffic detected: DNS query: api-iam.intercom.io
Source: global traffic	DNS traffic detected: DNS query: nexus-websocket-a.intercom.io
Source: global traffic	DNS traffic detected: DNS query: www.xero.com
Source: global traffic	DNS traffic detected: DNS query: s.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: c.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: xero.demdex.net
Source: global traffic	DNS traffic detected: DNS query: xerolimited.sc.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: www.dwin1.com
Source: global traffic	DNS traffic detected: DNS query: www.redditstatic.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: tracking.g2crowd.com
Source: global traffic	DNS traffic detected: DNS query: w3-reporting-nel.reddit.com
Source: global traffic	DNS traffic detected: DNS query: tags.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: s.yimg.com
Source: global traffic	DNS traffic detected: DNS query: secure.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: acdn.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: js.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: tag.demandbase.com
Source: global traffic	DNS traffic detected: DNS query: 9401320.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: alb.reddit.com
Source: global traffic	DNS traffic detected: DNS query: s.company-target.com
Source: global traffic	DNS traffic detected: DNS query: api.company-target.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: a.quora.com
Source: global traffic	DNS traffic detected: DNS query: c.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: tag-logger.demandbase.com
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: partners.tremorhub.com
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com
Source: global traffic	DNS traffic detected: DNS query: aax-eu.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: q.quora.com
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: rules.quantcount.com
Source: global traffic	DNS traffic detected: DNS query: sp.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: id.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: ara.paa-reporting-advertising.amazon
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pixel.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: segments.company-target.com
Source: global traffic	DNS traffic detected: DNS query: insight.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: tags.bluekai.com
Source: global traffic	DNS traffic detected: DNS query: xerolimited.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: user-tracking-api.dgt-digital-marketing.xero.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: ws.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: content.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: pixel.tapad.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: aa.agkn.com
Source: global traffic	DNS traffic detected: DNS query: secure-gl.imrworldwide.com
Source: global traffic	DNS traffic detected: DNS query: d.agkn.com
Source: global traffic	DNS traffic detected: DNS query: su.addthis.com
Source: global traffic	DNS traffic detected: DNS query: idpix.media6degrees.com
Source: global traffic	DNS traffic detected: DNS query: dmp.truoptik.com
Source: global traffic	DNS traffic detected: DNS query: tags.rd.linksynergy.com
Source: global traffic	DNS traffic detected: DNS query: uipglob.semasio.net
Source: global traffic	DNS traffic detected: DNS query: mid.rkdms.com
Source: global traffic	DNS traffic detected: DNS query: track2.securedvisit.com
Source: global traffic	DNS traffic detected: DNS query: ml314.com
Source: global traffic	DNS traffic detected: DNS query: eb2.3lift.com
Source: global traffic	DNS traffic detected: DNS query: metrics.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: match.sharethrough.com
Source: global traffic	DNS traffic detected: DNS query: cw.addthis.com
Source: global traffic	DNS traffic detected: DNS query: 940320.fls.doubleclick.net

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Activity Statement for User 01Apr2024-30Apr2024.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9261021b-d6b3-4329-ad49-31916ab92cef.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426171211Z-171.bmp

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5456

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Windows Analysis Report
Activity Statement for User 01Apr2024-30Apr2024.pdf